mailing list archives
RE: Publicly Disclosing A Vulnerability
From: "Josh Perrymon" <perrymonj () networkarmor com>
Date: Wed, 5 Oct 2005 13:17:42 -0500
I have already worked with the Client and Vendor and the vendor is providing a free upgrade to the customer for no
charge to correct the vulnerable issue.
My focus is to protect the customer first... The customer agreed that the vulnerability could be disclosed after they
So I guess the only part of this I didn't care for was the vendor saying that they did not want me to release this
information to the public.... I think it's because the client would get the upgrade for free instead of paying for it.
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of
Sent: Wednesday, October 05, 2005 10:52 AM
To: full-disclosure () lists grok org uk
Subject: [Full-disclosure] Publicly Disclosing A Vulnerability
I believe in working with the Vendor to inform then of vulnerable software upon finding it in the wild so on...
But I have a question...
While performing a pen-test for a large company I found a directory transversal vulnerability in a search program-
I used Achilles and inserted the DT attack in a hidden field and posted it to the web server. This returned the
Well... I called the company up and got the lead engineer on the phone.. He seemed a little pissed.
He told me that they found the hole internally a couple months ago but they don't want it public and they said I should
not tell anyone about it because they don't want their customers at risk.
So I ask the list- what is more beneficial to the customer? Not publicly disclosing the risk and hoping that they
follow the suggestions of the vendor to upgrade? Or waiting 30 days and send it out?
Sr. Security Consultant
A Division of Integrated Computer Solutions
perrymonj( at )networkarmor.com
Office: 850.205.7501 x1104
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Re: Publicly Disclosing A Vulnerability, (continued)