On Thu, 23 Mar 2006, Claus Assmann wrote:
> Ask ISS about the exploit. It definitely is a programming bug,
> just read the man page for setjmp() on an OpenBSD system.
I did, ISS indeed enlightened me. Didn't I ask for just that?
:)
> > It took Sendmail a mounth to fix this. A mounth.
>
> No. It took sendmail a week to fix this. The rest of the time was
> used to coordinate the release with all the involved vendors etc.
There are a few choices, full disclosure and "responsible disclosure" are
some. You can't do both. Releasing it out of nowhere, obfuscated in very
ineffective way, isn't it.
Not when it's critical infrastructure. With critical internet
infrastructure you need to be a tad bit smarter than that.
> Ask ISS about the exploit. It definitely is a programming bug,
> just read the man page for setjmp() on an OpenBSD system.
I did, ISS indeed enlightened me. Didn't I ask for just that?
:)
> > It took Sendmail a mounth to fix this. A mounth.
>
> No. It took sendmail a week to fix this. The rest of the time was
> used to coordinate the release with all the involved vendors etc.
There are a few choices, full disclosure and "responsible disclosure" are
some. You can't do both. Releasing it out of nowhere, obfuscated in very
ineffective way, isn't it.
Not when it's critical infrastructure. With critical internet
infrastructure you need to be a tad bit smarter than that.
Oh well, until the next sendmail vuln.
Gadi.
[ reply ]