Paul Schmehl wrote:
Heck yeah! See our issues with Compaq / HP earlier this summer... I was basically told sure you can cause a segfault but our non-executable stack is the holy grail and YOU can not touch it. Basically laughing in my face for even implying that I could take root on a TRU64 box via a buffer overflow. Without an exploit they claimed it was NOT possible. I have heard of similar horror stories with HP... anyone else care to share?On Wed, 2003-01-29 at 06:13, David Howe wrote:That is of course your choice. Vendors in particular were prone to deny a vunerability existed unless exploit code were published to prove it.I've read this mantra over and over again in these discussions, and a question occurs to me. Can anyone provide a *documented* case where a vendor refused to produce a patch **having been properly notified of a vulnerability** until exploit code was released?
You all know the outcome of that... a exploit was leaked they flipped out tryed to sue us and mircaulously you see patches in a few days.
-KF
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
