Re: [Full-disclosure] Compromising pictures of Microsoft Internet Explorer!

From: Bernhard Mueller (research_at_sec-consult.com)
Date: 07/17/05

  • Next message: Steven M. Christey: "Re: [Full-disclosure] RE: Why Vulnerability Databases can't do everything" 
    Date: Sun, 17 Jul 2005 22:09:45 +0200
To: Full Disclosure <full-disclosure@lists.grok.org.uk>

    > Mr. Zalewski's statement about the undue burden that Microsoft's
    > investigative processes place on the researcher is indeed accurate. The
    > only time I've had any success working with Microsoft was when the issue
    > was a straightforward code execution scenario. Oh wait... even then,
    > I'm blown off.

    the same here... when I mailed them about that COM-vulnerability in IE,
    they came up with "this is not exploitable, bla.." after two weeks of
    internal research
    and all. having a bad morning anyway, I decided to post the advisory and
    see, one day later there's a MS security advisory that "a COM object may
    crash internet explorer" (however, they forgot to mention the public
    bindshell exploit released by the fsirt).
    now recently MS05-37 came out, which somehow doesn't include any credits
      or mention of the original advisory whatsoever (the reason for that
    being, i presume, the lack of responsibility showed by us).
    I think it's rather strange to hear a billion-dollar software monopolist
    apply to my conscience like "look what you've done, you put our
    customers at risk". they wouldn't give a lame cent on the security of
    their customers if there wasn't a certain media hype about security.
    they care for their image and stock index, and that's about it. and i
    don't see why should be held responsible for that ;)

    regards,

    sk0L 

    -- 
_____________________________________________________
~  DI (FH) Bernhard Mueller
~  IT Security Consultant
~  SEC-Consult Unternehmensberatung GmbH
~  www.sec-consult.com
~  A-1080 Wien  Blindengasse 3
~  Tel:   +43/676/840301718
~  Fax:   +43/(0)1/4090307-590
______________________________________________________
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
  • Next message: Steven M. Christey: "Re: [Full-disclosure] RE: Why Vulnerability Databases can't do everything"

    Relevant Pages