Scanners and unpublished vulnerabilities - Full Disclosure

From: Alfred Huger (ah@securityfocus.com)
Date: 05/28/02 

Date: Tue, 28 May 2002 12:05:43 -0600 (MDT)
From: Alfred Huger <ah@securityfocus.com>
To: pen-test@securityfocus.com

Heya all,

Most of you who are long time users of this list know I tend to avoid
conversations on-list about full-disclosure. I'm of the opinion it's a
religious discussion with little or no merit for debate given that people
are unlikely to move from their current position.

Having said this every now and then something does occur within our
industry to spur discussion. In this case I came across something which
directly impacts the Pen-Testing arena and I would like to throw it out
for open discussion. The event in question is a new Vendor Notification
Alert Scheme the folks over at NGSSoftware announced yesterday. The
announcement can (and should be) read at:

http://www.nextgenss.com/news/vna.html

In brief they are now unloading limited details to the public about
vulnerabilities they have notified vendors about. Their reasoning behind
this is well thought out and I suggest you read the announcement before
jumping to a visceral conclusion one way or another. The way this impacts
the Pen-testing community is that these vulnerabilities which are in the
process (presumably) of being fixed are actively being coded into the
Typhon II Vulnerability Assessment Scanner from NGSSoftware. This
obviously is a significant issue which I suspect many of you out there
have opinions on. I have my own but I'll hold out on commenting till the
conversation gets under way (if it actually does so).

Lastly, before you post a reply - please read the provided URL. And for
those of you who are entirely disinterested in threads like this, please
accept my apologies in advance.

-al

VP Engineering
SecurityFocus
"Vae Victis"

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: Scanners and unpublished vulnerabilities - Full Disclosure
    ... I read it as "Buy our scanner and you'll have access to vulnerabilities ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: XSS vulnerability on Apache Tomcat server
    ... You might have found a CGI hosted on the server vulnerable to XSS, in any case once you find out for sure, then see if that website/CGI is responsible for issuing cookies or for the Authentication of cookies. ... If it is not, then your XSS alert is going to be an alert only in your Final Report, and you could say that the bad-coding or non-security conscious coding practices have been exercised during coding of CGI's. ... This list is provided by the SecurityFocus Security Intelligence Alert ... automatically alerts you to the latest security vulnerabilities please see: ...
    (Pen-Test)
  • RE: Laboratory Setup Help (RS)
    ... >> This list is provided by the SecurityFocus Security ... For more information on SecurityFocus' SIA service which ... >> vulnerabilities please see: ... >This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: Laboratory Setup Help (RS)
    ... You can find information on vulnerable packages from the distribution's ... GNU/Linux distributions (either the database or the advisories sent to ... > This list is provided by the SecurityFocus Security ... > vulnerabilities please see: ...
    (Pen-Test)
  • Re: Scanners and unpublished vulnerabilities - Full Disclosure
    ... > often the very latest vulnerabilities come into play in their work. ... SecurityFocus was working on for CORE ST to report to a series of vendors ... > holes Microsoft fixed. ...
    (Pen-Test)