RE: Fate Research Labs posting: RealSecure or Real"un"Secure

[Waterbury, Ronald P (Phil), GOVMK]

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------

Audra,

OK, that is an answer to the advisory but why hasn't the RDS vulnerability
been included in the product version upgrades/updates until now or maybe
more importantly, what is the policy/procedure for inclusion of checks in
the RealSecure product? (for instance, when the DDoS threat was new everyone
rushed to get signatures out to protect against it because the perceived
threat level was high- what made ISS decide that DDoS was a high threat?
And why wasn't RDS viewed that way?) RDS was known to be a dangerous
vulnerability (as quoted in the advisory) and has been out for quite a long
time.  Having some user defined signature code is OK for a short term
solution but not for a total solution- people expect the product to be
updated by the vendor not by them (for good or bad).

Phil