Vulnerability Development: Vendor Changelogs /Notifications

[quentyn () fotango com]

This is really a generic query

Is it appropriate to send notifications to public lists if you spot that
a vendor has fixed a serious security hole ( mentioned only in the
change log) but hasn't sent any notification and doesn't have any
notification on their site ? Other than using the product ( and reading
change logs) I have had nothing to do with this issue.

My concern is that people may continue to run the affected version with
out noticing that there is a fix. Certainly, certain vendors appear to
be quite good about posting to bugtraq etc. al to inform of problems and
fixes in their products, others appear not so pro-active about informing
people.



Q


-- 
#####################
Quentyn Taylor
Sysadmin - Fotango
#####################
Never anger a dragon, for you are crunchy and good with ketchup.