Re: ZDI-09-018: Symantec Client Security Alert Originator Service- Stack Overflow Vulnerability

From: Steve Shockley <steve.shockley@shockley.net>
To: ZDI Disclosures <zdi-disclosures@tippingpoint.com>
Cc: bugtraq <bugtraq@securityfocus.com>
Subject: Re: ZDI-09-018: Symantec Client Security Alert Originator Service- Stack Overflow Vulnerability
Date:


On 4/28/2009 4:39 PM, ZDI Disclosures wrote:
> an attacker can overflow that buffer leading
> to arbitrary code execution in the context of the SYSTEM user.

> -- Disclosure Timeline:
> 2007-09-14 - Vulnerability reported to vendor
> 2009-04-28 - Coordinated public release of advisory

WTF?  What ever happened to using the threat of disclosure to get 
vendors to patch their bugs in a timely manner?  They even released new 
major versions of the product during that time and they're still vulnerable.

I guess responsible disclosure (from the consumer's point of view) isn't 
something polite corporations do.





Copyright © 1995-2019 LinuxRocket.net. All rights reserved.