On 4/28/2009 4:39 PM, ZDI Disclosures wrote:
> an attacker can overflow that buffer leading
> to arbitrary code execution in the context of the SYSTEM user.
> -- Disclosure Timeline:
> 2007-09-14 - Vulnerability reported to vendor
> 2009-04-28 - Coordinated public release of advisory
WTF? What ever happened to using the threat of disclosure to get
vendors to patch their bugs in a timely manner? They even released new
major versions of the product during that time and they're still vulnerable.
I guess responsible disclosure (from the consumer's point of view) isn't
something polite corporations do.
> an attacker can overflow that buffer leading
> to arbitrary code execution in the context of the SYSTEM user.
> -- Disclosure Timeline:
> 2007-09-14 - Vulnerability reported to vendor
> 2009-04-28 - Coordinated public release of advisory
WTF? What ever happened to using the threat of disclosure to get
vendors to patch their bugs in a timely manner? They even released new
major versions of the product during that time and they're still vulnerable.
I guess responsible disclosure (from the consumer's point of view) isn't
something polite corporations do.
[ reply ]