Re: IE7 is a Source of Problem - Secunia IE7 Release Incident of October 2006



"Let me sum up: in this case IE is vulnerable, only IE is vulnerable,
and Microsoft say "These reports are technically inaccurate: the issue
concerned in these reports is not in Internet Explorer 7 (or any other
version) at all".

I assume that bugtraq is an objective security list. Subjective
opinions? I do not think so.

If you post saying "X" product is vulnerable, you should be able to
demonstrate it. From a security researcher standpoint, the important
thing is where the flaw is located, since your products/company could be
exposing the flawed component through a bunch of attack vectors.
So let's imagine that Microsoft had released an advisory just saying
that the culprit is Internet Explorer ONLY. It wouldn't be very funny if
you are using that mhtml component within your own product, since you
would think: "Ok, no problem, IE is vulnerable ONLY". What would happen
if you have to write down a vulnerability report on it?.

Btw, you have censored an important part of the original "advisory" for
your own profit :

----
"Let me sum up: in this case IE is vulnerable, only IE is vulnerable,
and Microsoft say "These reports are technically inaccurate: the issue
concerned in these reports is not in Internet Explorer 7 (or any other
version) at all" -> "Rather, it is in a different Windows component,
specifically a component in Outlook Express. While these reports use
Internet Explorer as a vector the vulnerability itself is in Outlook
Express"
"
----

Attack vectors != vulnerabilities

For example, is a vuln within the Quicktime Browser plugin the same
that a flaw within the own IE? I don't think so.

I am not defending Microsoft. I am defending that every
vendor/researcher should release proper advisories, i.e When Microsoft
hid information in a security bulletin few months ago,( NtClose
DeadLock issue/MS06-30), I posted to the list objective technical
details demonstrating it. If you have technical details demonstrating
that a shared component is not the culprit, but IE does, I'll shut up
myself. Frankly, I only trust in technical reasoning, I don't mind who
is the vendor.

Regards,
Rubén.



Relevant Pages

  • Re: Microsoft Security Bulletin MS03-040 - 828750
    ... cross-posts fake Microsoft Security bulletins [which, by the way, ALSO have ... Cumulative Patch for Internet Explorer ... A vulnerability that occurs because Internet Explorer does not ... It could be possible for an attacker who exploited this ...
    (microsoft.public.win2000.security)
  • Re: Microsoft Security Bulletin MS03-040 - 828750
    ... cross-posts fake Microsoft Security bulletins [which, by the way, ALSO have ... Cumulative Patch for Internet Explorer ... A vulnerability that occurs because Internet Explorer does not ... It could be possible for an attacker who exploited this ...
    (microsoft.public.security)
  • Re: Microsoft Security Bulletin MS03-040 - 828750
    ... cross-posts fake Microsoft Security bulletins [which, by the way, ALSO have ... Cumulative Patch for Internet Explorer ... A vulnerability that occurs because Internet Explorer does not ... It could be possible for an attacker who exploited this ...
    (microsoft.public.security.virus)
  • [Full-disclosure] Fwd: IE7 is a Source of Problem - Secunia IE7 Release Incident of October
    ... IE7 is a Source of Problem - Secunia IE7 Release Incident ... I am not defending Microsoft. ... and Microsoft say "These reports are technically inaccurate: ... if you have to write down a vulnerability report on it?. ...
    (Full-Disclosure)
  • [NT] Cumulative Security Update for Internet Explorer (MS05-020)
    ... A remote code execution vulnerability exists in Internet Explorer because ... * Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service ... Note Setting the level to High may cause some Web sites to work ...
    (Securiteam)