Tag: Vulnerability Disclosure

  • Month of MySpace Bugs (MOMSB)

    [This was originally published on the OSVDB blog.] Yes, the trend continues and gets more .. odd. The Washington Post decided to cover this story giving it more attention than it probably deserves. From the home page of the effort: The purpose of the exercise is not so much to expose Myspace as a hive…

  • Month of PHP Bugs

    [This was originally published on the OSVDB blog.] Hell hath no fury like a PHP developer scorned… http://blog.php-security.org/archives/46-Month-of-PHP-bugs.html During the last months there have been the Month of the Browser bugs and the Month of the Kernel bugs projects that tried to raise awareness for security vulnerabilities in browsers and kernels. After thinking a bit…

  • Month of .. who?!

    [This was originally published on the OSVDB blog.] http://rixstep.com/2/20070104,00.shtml A Month of Rixstep Bugs It’s a win-win proposition. Starting now and for the duration of January 2007 Rixstep will be holding a ‘Month of Rixstep Bugs’ campaign: find a bug in any Rixstep software product and win a prize. It’s not a win-win proposition, it…

  • reply: MJR: The Vulnerability Disclosure Game: Are We More Secure?

    [This was originally published on the OSVDB blog.] The Vulnerability Disclosure Game: Are We More Secure?http://www2.csoonline.com/exclusives/column.html?CID=28072By Marcus J. Ranum Do you remember the original premise of the disclosure game? By publicly announcing vulnerabilities in products we will force the vendors to be more responsive in fixing them, and security will be better. Remember that one?…

  • reply: Microsoft: Responsible Vulnerability Disclosure Protects Users

    [This was originally published on the OSVDB blog.] Microsoft: Responsible Vulnerability Disclosure Protects Usershttp://www2.csoonline.com/exclusives/column.html?CID=28071By Mark Miller, Director, Microsoft Security Response Center Responsible disclosure, reporting a vulnerability directly to the vendor and allowing sufficient time to produce an update, benefits the users and everyone else in the security ecosystem by providing the most comprehensive and highest-quality…

  • Bogus RFI Reports Getting Out of Hand

    [This was originally published on the OSVDB blog.] I know we’re all getting tired of the Remote File Inclusion (RFI) vulnerabilities being disclosed that end up being debunked, but this one takes the cake so far (yes I’m behind on e-mail). Fri Jun 16 2006http://archives.neohapsis.com/archives/bugtraq/2006-06/0321.html(1) path/action.php, and to files in path/nucleus including (2) media.php, (3)…

  • [product] (script.php) Remote File Include [exploit|vulnerability]

    [This was originally published on the OSVDB blog.] Somewhere out there is a point-and-click web application that allows neophyte “security researchers” (yes, that is a joke) to quickly whip up their very own Bugtraq or Full-Disclosure post. I’m sure others have noticed this as well? More and more of the disclosures have too much in…

  • Month of Kernel Bugs (MoKB)

    [This was originally published on the OSVDB blog.] First it was the Month of Browser Bugs (MoBB), now it is the Month of Kernel Bugs (MoKB). When I first read about it, I immediately thought of thirty odd entries about Linux Kernel Local DoS conditions. My pessimism is born out of the numerous local DoS…

  • Insert a classy pun.

    [This was originally published on the OSVDB blog.] This entry should have been published days ago. On top of being overly busy and spread thin, I ran into a big problem related to finding a reference I wanted to include, which will lead to this being a little more ranty than intended. How is it…

  • Full Disclosure Debate Bibliography

    [This was originally published on the OSVDB blog.] Paul Clark, Systems Librarian at the Wilderness Coast Public Libraries, has created an excellent timeline of Full Disclosure related articles. Unfortunately, mail to him is bouncing and it hasn’t been updated since 2004. Would be great to see someone pick this up.