Re: Public announcements of SQL Security Vulnerabilities
From: Ernest DeVore (devore_ernest@hotmail.com)
Date: 07/31/02
- Next message: BP Margolin: "Re: How to register SQL 2000"
- Previous message: Fabrizio: "How to register SQL 2000"
- In reply to: Chris Wood: "Re: Public announcements of SQL Security Vulnerabilities"
- Next in thread: Chris Wood: "Re: Public announcements of SQL Security Vulnerabilities"
- Reply: Chris Wood: "Re: Public announcements of SQL Security Vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Ernest DeVore" <devore_ernest@hotmail.com> Date: Wed, 31 Jul 2002 10:25:05 -0500
"Chris Wood" <chris.wood@gov.ab.ca> wrote in message
news:euC8XBxNCHA.2680@tkmsftngp09...
> BP,
>
> What I am questioning is that the exploit script appear so early after the
> fix is issued. Is a few hours an ethical amount of time. Remember that the
> internet is always on and a fix and exploit code could be published after
we
> finish work and before we start again the following day or even over a
> weekend.
>
> The current set of comments all seem to think that we should thank our
lucky
> stars that the exploit code does not appear before the bug is fixed.
It's the old saw. Ignorance is bliss but it doesn't make the problem go
away.
If you go into the hacker forums and websites you'll find that they all love
to talk about what they've done and impress each other with their
brilliance. That's human nature. They all share their information and those
exploits are known in the hacker communities for quite awhile before some of
the
good guys who watch those communities pick up the information and bring it
to the public eye.
By the time you see an exploit I can guarantee you that the top 10% hackers,
which are the truly motivated and Type-A personalities, already know about
it. By publishing
the exploit and example source codes you're letting in the rest of the slow
dogs but you're also alerting us hard-working DBAs who don't have time to
browse all the hacker
communities out there. There are five other DBAs at any given time wanting
my job. I don't want my competence to be called into question by something
as silly as a buffer
overrun exploit I'd never heard about but that some hacker used to bring my
systems down.
I thank the SQL gods every day for those websites that go forth into Indian
Territory to bring us the bad news.
/E
- Next message: BP Margolin: "Re: How to register SQL 2000"
- Previous message: Fabrizio: "How to register SQL 2000"
- In reply to: Chris Wood: "Re: Public announcements of SQL Security Vulnerabilities"
- Next in thread: Chris Wood: "Re: Public announcements of SQL Security Vulnerabilities"
- Reply: Chris Wood: "Re: Public announcements of SQL Security Vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
