Re: [Full-disclosure] 0day: PDF pwns Windows

On 25 Sep 2007, at 00:57, Lamont Granquist wrote:

The exploit is not made public by its use. The exploit is not even made public by (back-channel) sharing amongst the hacker/cracker community. The exploit is only made public if detected or the vulnerability is disclosed. Until detected/disclosed the hacker/ cracker can use their 31337 0day spl01tz to break into whichever vulnerable machines they like. 0day exploits are valuable because the opposition is ignorant of them.

Posting exploits to BUGTRAQ, however, inherently makes them not 0day...

And my ignorant self thought until this thread that the "0" in the term referred to the number of days of head start granted to the vendor. Silly me. Because that would make all vulnerabilities published without prior warning to the vendor a "0day"...

Roland (who seems to remember that this was once the meaning of this term)

Attachment: PGP.sig
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: 0day: PDF pwns Windows
    ... made public by sharing amongst the hacker/cracker community. ... The exploit is only made public if detected or the vulnerability is disclosed. ... Because that would make all vulnerabilities published without prior warning to the vendor a "0day"... ...
    (Bugtraq)
  • Administrivia: Response to OIS Draft on "Security Vulnerability and Response Process"
    ... vulnerability or not. ... to see what they can expect, at each Vendor, or for each Coordinator, ... and possibly a lot longer if the Finder doesn't pester ... security of users, critical infrastructures, and the Internet"...and ...
    (NT-Bugtraq)
  • RE: [fw-wiz] CERT vulnerability note VU# 539363
    ... Vendor Statement ... NetScreen has studied the issues raised in this vulnerability alert. ... netscreens claims on the single side of the 'two' attack methods ... >> In my opinion if a stateful firewall claims it can filter at rate X ...
    (Firewall-Wizards)
  • What Vendors need to know about vulnerability reporting
    ... vulnerability prior to the public-at-large...pay attention. ... discoverers of vulnerabilities are ... Much of this has been documented in the NTBugtraq Disclosure Policy for more ... Join the NTBugtraq Vendor Awareness Network, ...
    (NT-Bugtraq)
  • @stake advisory: HP dced Remote Command Execution Multiple OSes
    ... Vendor Status: Vendor has patches ... A buffer overflow vulnerability was discovered in HP's implementation ... HP-UX 11 with patches noted in bulletin HPSBUX0311-299 fixed this ... Common Vulnerabilities and Exposures (CVE) Information: ...
    (Bugtraq)