mailing list archives
Re: Publicly Disclosing A Vulnerability
From: "Martijn Lievaart" <m () rtij nl>
Date: Wed, 5 Oct 2005 17:18:13 +0200 (CEST)
Josh Perrymon zei:
[ directory transversal vulnerability in a search program ]
So I ask the list- what is more beneficial to the customer? Not publicly
disclosing the risk and hoping that they follow the suggestions of the
vendor to upgrade? Or waiting 30 days and send it out?
First look at the contract for the pentest. Are you allowed to disclose
this? Often your contract prevents this. Be careful!
(but then magically someone else who is not under contract or NDA finds
this bug a few weeks later....)
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/