Home page logo

fulldisclosure logo Full Disclosure mailing list archives

RE: MSIE (mshtml.dll) OBJECT tag vulnerability
From: "Tim Bilbro" <trbilbro () verizon net>
Date: Mon, 01 May 2006 14:51:23 -0400

Bkfsec wrote:


"What you do usually see with full disclosure (likewise with patching),

which is ironically dragged out as an argument against full disclosure,

is that when a flaw is disclosed, you do see script kiddies coming out 
of the woodwork making loud noises with automated bots mass-owning 
systems.  Is this the fault of full disclosure?  Nope.  It's 
inevitable.  "

I don't think it is inevitable. Think about browser DoS vulnerabilties.
An stealth blackhat wouldn't bother with that type of exploit. It's
brute force, messy, doesn't get you root and it's trackable to some
degree. But, lesser hackers will immediately adopt exploits that just
crash the browser for example. So, by publishing that type of exploit
and labeling it crtical you create a new requirement for mitigation that
wouldn't otherwise be there. 

Some have suggested a 'Vulnerability Escrow' A third party that tracks
and holds vulnerability discoveries and works with the vendor. I think
that is an idea worth exploring. 


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]