Re: Vendor Changelogs /Notifications

From: Blue Boar (BlueBoar@thievco.com)
Date: 09/05/02 

Date: Thu, 05 Sep 2002 12:14:59 -0700
From: Blue Boar <BlueBoar@thievco.com>
To: vuln-dev@securityfocus.com

quentyn@fotango.com wrote:
> Is it appropriate to send notifications to public lists if you spot that
> a vendor has fixed a serious security hole ( mentioned only in the
> change log) but hasn't sent any notification and doesn't have any
> notification on their site ? Other than using the product ( and reading
> change logs) I have had nothing to do with this issue.

It has been done before, both on Bugtraq and here. It's probably
appropriate to both places, Bugtraq so people are aware there's a problem
and fix, and here, since the vulnerability may not have been otherwise
explored.

                                                BB