ISS Advisory clarification

["Klaus, Chris (ISSAtlanta)" <CKlaus () iss net>]

Quick clarification on several points based on emails that I've received:

1)      We did notify Apache before going public.  ISS X-Force emailed
Apache in the morning at 9:44am regarding this Advisory.  We waited until
the afternoon before sending to Bugtraq for approval and finally reaching
the Bugtraq mailing list archive at approximately Jun 17 2002 3:57PM.
2)      Apache was not aware that a remote exploit vulnerability existed
until ISS X-Force alerted them to the seriousness of this.  They were
working on denial of service issues.
3)      ISS X-Force patch did work against the remote exploit that we found
and it did address the Gobbles exploit.  While our patch did properly work
against the remote exploits, we recommend using the official Apache patch.
Apache's updated patch includes fixes for the remote exploit and denial of
service attacks. 
4)      While the general nature of open-source and its virtual
organizations do have enforcement of strict confidentiality issues, this is
not true for every single open-source project.  This is based on the past
experience.  We have seen where open-source projects spread information
immediately in the wild and we have seen some that are organized to maintain
confidentiality.  ISS X-Force deals with all vendors on a case-by-case basis
to provide maximum protection for our customers and the community.
 
We are currently working with another major vulnerability dealing with an
open-source vendor whereby we both are coordinating and cooperating and
shrinking the 30 day quiet period significantly to quickly provide a patch
to the public.  We are trying to learn from our experience and continue to
improve the advisory release process.  We are hoping this next major
advisory will be received more positively.


***********************************************************************
Christopher W. Klaus
Founder and CTO
Internet Security Systems (ISS)
6303 Barfield Road
Atlanta, GA 30328
Phone: 404-236-4051 Fax: 404-236-2637
web http://www.iss.net
NASDAQ: ISSX
Internet Security Systems ~ The Power To Protect