Re: Publicly Disclosing A Vulnerability

[Steve Friedl <steve () unixwiz net>]

On Wed, Oct 05, 2005 at 09:52:14AM -0500, Josh Perrymon wrote:
> Well... I called the company up and got the lead engineer on
> the phone.. He seemed a little pissed.

This seems to be a common vendor response: yuck.

> So I ask the list- what is more beneficial to the customer? Not publicly
> disclosing the risk and hoping that they follow the suggestions of the
> vendor to upgrade?  Or waiting 30 days and send it out?

If the vendor knows which customer you're doing the work for, it's not
really your call to make.

Your customer still has to work with the vendor after you're gone, and
going public - which I think is a fine idea in general - could sour a
relationship that's not yours to sour. Ask the customer what they want
to do with this, but if you're covered under NDA (as you surely must be)
I'm pretty sure you have to sit on it if they tell you to.

This is a customer-service issue, not a security issue. And a bummer.

Steve

--- 
Stephen J Friedl | Security Consultant |  UNIX Wizard  |   +1 714 544-6561
www.unixwiz.net  | Tustin, Calif. USA  | Microsoft MVP | steve () unixwiz net
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/