Not true. Mark Litchfield had already reported it to Apache and they were working on a fix when ISS published. The problem was getting fixed and if ISS would have waited a few days, like the person who discovered it (Mark), everyone would have had a chance to install the fix before the whole world knew.

Regarding gobbels: If they are so wonderful why did they 1) provide the exploit to their friend months ago so their friend could use the exploit and 2) Only speak up when the bug was about to be fixed. I suspect they feared that once the fix was out they would miss out on fame and glory. If Goebells is so nobel, why didn't they tell Apache privately months ago when they found the exploit?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/493/13184#13184