[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUB2WodQCwYW3VvfJGKq59Yy3VtDA4q9sJaiph3AqFVLwQ@mail.gmail.com>
Date: Sat, 25 Jul 2015 14:18:05 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Qualys Security Advisory - CVE-2015-3245
userhelper - CVE-2015-3246 libuser
> Frankly, over the years I have seen pretty few people on the side of the
> angels complain that "But *why* didn't you include a weaponized exploit
> with your advisory? I feel so cheated!".
AFAICT, virtually all the open-source and closed-source security
testing tools are dependent on the availability of this information;
this certainly includes Nessus, most web security scanners, most AV
software, etc.
> In these situations, where an exploit for a new local root vulnerability
> turned up without prior warning, we typically started seeing root-level
> incidents within 24 hours. Have you ever tried to get big organizations,
> made up of a zillion independent entities, to apply security patches
> within a timescale of hours?
Would you choose not to do this in situations where no public exploit
is available, and therefore you would be unlikely to see the
immediately evident nuisance attacks described in your message?
Starting with the premise that the disclosure of security bugs makes
computer systems more vulnerable to attacks, would it be preferable to
completely discourage sharing vulnerability information with the
general public? If not, why?
/mz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
