Re: Publicly Disclosing A Vulnerability

["Martijn Lievaart" <m () rtij nl>]

Josh Perrymon zei:
> Ok,
[ directory transversal vulnerability in a search program ]
> So I ask the list- what is more beneficial to the customer? Not publicly
> disclosing the risk and hoping that they follow the suggestions of the
> vendor to upgrade?  Or waiting 30 days and send it out?

First look at the contract for the pentest. Are you allowed to disclose
this? Often your contract prevents this. Be careful!

M4
(but then magically someone else who is not under contract or NDA finds
this bug a few weeks later....)


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/