Bugtraq mailing list archives

Re: ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability

From: Steve Shockley <steve.shockley () shockley net>
Date: Wed, 29 Apr 2009 16:54:00 -0400

On 4/28/2009 4:39 PM, ZDI Disclosures wrote:

an attacker can overflow that buffer leading
to arbitrary code execution in the context of the SYSTEM user.

-- Disclosure Timeline:
2007-09-14 - Vulnerability reported to vendor
2009-04-28 - Coordinated public release of advisory

WTF? What ever happened to using the threat of disclosure to getvendors to patch their bugs in a timely manner? They even released newmajor versions of the product during that time and they're still vulnerable.

I guess responsible disclosure (from the consumer's point of view) isn'tsomething polite corporations do.

Current thread:

ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability ZDI Disclosures (Apr 29)
- Re: ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability Steve Shockley (Apr 30)