BugTraq
0day: PDF pwns Windows Sep 20 2007 01:21PM
pdp (architect) (pdp gnucitizen googlemail com) (3 replies)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 21 2007 07:53PM
Thierry Zoller (Thierry Zoller lu) (2 replies)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 21 2007 09:21PM
Aaron Collins (collinsa ehawaii gov)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 21 2007 09:21PM
Kevin Finisterre (lists) (kf_lists digitalmunition com)
Re: 0day: PDF pwns Windows Sep 20 2007 04:55PM
Aditya K Sood (zeroknock secniche org)
Re: 0day: PDF pwns Windows Sep 20 2007 03:29PM
Gadi Evron (ge linuxbox org) (1 replies)
Re: 0day: PDF pwns Windows Sep 20 2007 11:16PM
Crispin Cowan (crispin novell com) (2 replies)
Gadi Evron wrote:
> Impressive vulnerability, new. Not a 0day.
>
> Not to start an argument again, but fact is, people stop calling
> everything a 0day unless it is, say WMF, ANI, etc. exploited in the
> wild without being known.
>
> I don't like the mis-use of this buzzword.
I respectfully disagree. By your definition, we have:

* "new vulnerability" is just what it sounds like
* "0day" is a "new vulnerability" that comes to public attention
because someone used it maliciously

But then there is the important concept of the "private 0day", a new
vulnerability that a malicious person has but has not used yet.

Does it really matter how the new vulnerability came to light? Do you
really want to get into arguments about whether the person who
discovered it was malicious? Especially for "private 0days" where the
discoverer may be sitting on his discovery for some time, waiting for
the highest bider to buy his result. If he sells it to criminals, then
it becomes an 0day, and if he sells it to a vulnerability marketing
company, then it is something else.

I don't like this chain of logic. Whether a new vulnerability is an 0day
or not depends entirely too much on the disclosure process, with funky
race conditions in there.

Rather, I just treat "0day" as a synonym for "new vulnerability" and
don't give a hoot about the alleged intentions of whoever discovered it.
What makes it an "0" day is that whoever is announcing it is first to
announce it in public. You could only invalidate the 0day claim by
showing that the same vulnerability had previously been disclosed by
someone else.

Crispin

--
Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/
Director of Software Engineering http://novell.com
AppArmor Chat: irc.oftc.net/#apparmor

[ reply ]
Re: 0day: PDF pwns Windows Sep 23 2007 05:34AM
Crispin Cowan (crispin novell com) (2 replies)
Re: 0day: PDF pwns Windows Sep 25 2007 04:15PM
Iggy E (iggy_e yahoo com)
Re: 0day: PDF pwns Windows Sep 23 2007 11:52PM
Chad Perrin (perrin apotheon com) (2 replies)
Re: 0day: PDF pwns Windows Sep 24 2007 10:57PM
Lamont Granquist (lamont scriptkiddie org) (1 replies)
Re: 0day: PDF pwns Windows Sep 25 2007 05:57PM
Roland Kuhn (rkuhn e18 physik tu-muenchen de) (1 replies)
RE: 0day: PDF pwns Windows Sep 25 2007 06:39PM
Thor (Hammer of God) (thor hammerofgod com) (2 replies)
Re: 0day: PDF pwns Windows Sep 25 2007 09:03PM
Steve Shockley (steve shockley shockley net)
defining 0day Sep 25 2007 07:02PM
Gadi Evron (ge linuxbox org) (3 replies)
RE: defining 0day Sep 25 2007 09:20PM
David Gillett (gillettdavid fhda edu)
Re: defining 0day Sep 25 2007 08:40PM
Charles Miller (cmiller pastiche org) (2 replies)
Re: defining 0day Sep 26 2007 11:25PM
Zow Terry Brugger (zow llnl gov) (1 replies)
Re: defining 0day Sep 26 2007 11:10PM
Chad Perrin (perrin apotheon com) (1 replies)
RE: defining 0day Sep 28 2007 12:20AM
Marvin Simkin (Marvin Simkin asu edu) (1 replies)
Re: defining 0day Sep 27 2007 06:34PM
Chad Perrin (perrin apotheon com)
Re: defining 0day Sep 25 2007 08:57PM
Gadi Evron (ge linuxbox org)
Re: defining 0day Sep 25 2007 07:51PM
Brian Loe (knobdy gmail com) (1 replies)
Re: defining 0day Sep 25 2007 07:59PM
Gadi Evron (ge linuxbox org) (1 replies)
Re: defining 0day Sep 25 2007 08:15PM
Brian Loe (knobdy gmail com) (1 replies)
Re: defining 0day Sep 25 2007 08:37PM
Adrian Griffis (adriang63 gmail com) (2 replies)
Re: defining 0day Sep 25 2007 09:05PM
Andrew Weaver (aweaver ee net)
Re: defining 0day Sep 25 2007 08:54PM
Brian Loe (knobdy gmail com)
Re: 0day: PDF pwns Windows Sep 24 2007 09:59PM
Crispin Cowan (crispin novell com) (1 replies)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 25 2007 01:39PM
J. Oquendo (sil infiltrated net)
Re: 0day: PDF pwns Windows Sep 21 2007 06:34PM
Casper Dik Sun COM (1 replies)
Re: 0day: PDF pwns Windows Sep 21 2007 07:24PM
J. Oquendo (sil infiltrated net)


 

Privacy Statement
Copyright 2010, SecurityFocus