Re: Re: Full Disclosure != Exploit Release

[KF <dotslash () snosoft com>]

Paul Schmehl wrote:
> On Wed, 2003-01-29 at 06:13, David Howe wrote:
>
>
> > That is of course your choice. Vendors in particular were prone to deny
> > a vunerability existed unless exploit code were published to prove it.
>
>
> I've read this mantra over and over again in these discussions, and a
> question occurs to me.  Can anyone provide a *documented* case where a
> vendor refused to produce a patch **having been properly notified of a
> vulnerability** until exploit code was released?

Heck yeah! See our issues with Compaq / HP earlier this summer... I was 
basically told sure you can cause a segfault but our non-executable 
stack is the holy grail and YOU can not touch it. Basically laughing in 
my face for even implying that I could take root on a TRU64 box via a 
buffer overflow. Without an exploit they claimed it was NOT possible. I 
have heard of similar horror stories with HP... anyone else care to share?

You all know the outcome of that... a exploit was leaked they flipped 
out tryed to sue us and mircaulously you see patches in a few days.

-KF



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html