Details of Sybase ASE bugs withheld
From: NGSSoftware Insight Security Research (nisr_at_NEXTGENSS.COM)
Date: Mon, 21 Mar 2005 18:42:59 -0000 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
In 2004, NGSS reported a number of serious security issues in Sybase ASE to
Sybase, which Sybase has released patches for:
NGSS advise all Sybase ASE customers to review the advice that Sybase
provided in the alert above, and apply the relevant patches as soon as is
In line with our responsible disclosure policy, NGSS generally withhold
technical information about vulnerabilities for three months after the
vendor has provided a patch. NGSS do this in order to ensure that customers
have sufficient time to apply the patch, or otherwise protect themselves in
line with the vendor's advice before the details are made available to the
general public. After three months, the technical details are then
disclosed, in order to allow security auditors and network administrators to
fully understand the impact of the issues concerned, to prove that patches
have been applied correctly, and to implement more specific workarounds.
NGSS were due to publish the full technical details of the vulnerabilities
concerned on the 21st of March 2005.
On the morning of the 21st of March, NGSS received a letter from the Sybase
legal team requesting that NGSS withhold technical details of these serious
vulnerabilities indefinitely. Consequently, NGSS feel unable to publish the
technical details of these bugs until the legal situation has been resolved.
NGSS believe that it is not in the best interest of Sybase customers for
Sybase to prevent publication of the technical details of these bugs.
-- NTBugtraq Editor's Note: Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered. --