I think people were quick to jump on the bandwagon pointing fingers at ISS. Yes, they did release this advisory a little irresponsibly, but what if they kept this bug for themselves? Other researchers found the same bug, but we all (Apache users) could have been left vulnerable to this bug and all it would have taken is some #!darknet 0-day junkie to write a small script that would automatically compromise systems and spread itself to other systems. I think ISS will disclose future bugs more responsibly.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/91/13336#13336