I believe the reason this has been happening to Microsoft for years is simply because of the sheer number of vulnerabilities found by various individuals. Many of the people discovering vulnerabilities in Microsoft's products do not necessarily subscribe to the Responsible Disclosure rules; or at least the unwritten/unratified rules that exist. ISS is a company that has subscribed to these rules for other cases (Microsoft and Non-Microsoft). I am not a conspiracy theorist, but IMHO it seems that ISS was trying to beat anyone else who was hot on this vulnerability to the presses. A massive PR opportunity existed for ISS by saying that they were the company that discovered the first vulnerability in software which has not been exploitable for over four years.

Brian

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/91/13322#13322