[37269] in bugtraq
Re: [Full-Disclosure] MSIE src&name property disclosure
daemon@ATHENA.MIT.EDU (Dave Aitel)
Mon Nov 8 19:30:24 2004
Message-ID: <418F8747.40200@immunitysec.com>
Date: Mon, 08 Nov 2004 09:48:39 -0500
From: Dave Aitel <dave@immunitysec.com>
MIME-Version: 1.0
To: Michal Zalewski <lcamtuf@ghettot.org>
Cc: Berend-Jan Wever <skylined@edup.tudelft.nl>,
full-disclosure@lists.netsys.com, bugtraq@securityfocus.com
In-Reply-To: <20041108150913.X14239@dekadens.coredump.cx>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Michal Zalewski wrote:
>On Mon, 8 Nov 2004, Berend-Jan Wever wrote:
>
>
>
>>In response to statements found at
>>http://news.com.com/Exploit+code+makes+IE+flaw+more+dangerous/2100-1002_3-5439370.html
>>
>>
>
>Yup.
>
>But what amuses me most, is the following bit:
>
> "Microsoft has begun to investigate the Iframe vulnerability and has not
> been made aware of any program designed to exploit the flaw, the company
> said in an e-mail statement to CNET News.com."
>
>When you posted your first message confirming that the problem is
>exploitable, I forwarded it to secure@microsoft.com, so that they know
>they have a problem in case they do not read Full-Disclosure. I got no
>response. Later, when you posted a working exploit, I sent them another
>forward, including a remark it is probably a good idea to react now, if
>they failed to do so before.
>
>In response, I got a mail from "Lennart" of Microsoft Security Response
>Center, saying that they are aware of the problem and read mailing lists,
>and that my original mail simply got lost in the noise.
>
>Several days later, this statement surfaces in an article, showing beyond
>any doubt that they are, quite simply, lying to the public to save face
>and gain time.
>
>As much as I am not a rabid Microsoft hater, this pissed me off more than
>a bit.
>
>
>
The really insidious thing is how they always attempt to claim that
their version of disclosure policy is "commonly accepted" when nothing
could be further from the truth. The security community, including most
security consulting companies, follows a wide range of policies. Most of
these policies have very little in common with Microsoft's policy, which
they call "Responsible Disclosure (tm)." Of course, they themselves do
not practice responsible disclosure to their customers. If they did,
then EVERY vulnerability they discovered internally would be in an
advisory. This is how it is done in organizations that truly do want to
protect their customers, such as the Linux community.
This is another reason why studies comparing Microsoft's security to
Open Source security are always bizzare. They compare the entire set of
Linux vulnerabilities to a tiny subset of the bugs Microsoft knows
about, but pretends other people don't. WINS is a classic example.
Dave Aitel
Immunity, Inc.
