Re: A.L.E.R.T.: BigMailBox.com href tokens leave mailboxes open to control by a malicious site.

On Wed, 23 Feb 2000, Jim Paris wrote:

> > BigMailBox.com was notified of the problem on Fri, 11 Feb 2000. After
> > additional testing and verification, staff of BigMailBox.com patched
> > the vulnerability on Mon, 14 Feb 2000.
> ...
> > Contact BigMailBox and complain about shoddy and insecure e-mail access.
>
> They patched the hole in 3 days (over a weekend, no less!). I don't
> think that demands mass complaints about "shoddy and insecure"
> e-mail. They seem to have been very responsible about the bug.

The fix did not occur three days following notification. After posting
our notice, we were notified by another Bugtraq subscriber that said
vulnerability had been previously posted to Bugtraq over a *month* ago.
(Yeah, we missed that, but so did BigMailBox.)

.c
Received on Feb 24 2000