Re: [Full-disclosure] what we REALLY learned from WMF

2006-01-06 Thread Florian Weimer
* Gadi Evron: > What we really learn from this all WMF "thingie", is that when Microsoft > wants to, it can. > > Microsoft released the WMF patch ahead of schedule > ( http://blogs.securiteam.com/index.php/archives/181 ) > > Yep, THEY released the PATCH ahead of schedule. They already did that f

Re: [Full-disclosure] what we REALLY learned from WMF

2006-01-05 Thread Nick FitzGerald
Niek wrote: > MS appearantly had the patch read on 28 december 2005. > Suppose they released it 48 hours later, because the flaw is so serious. > Suppose everyone praises MS because they tackled it so quickly. > Suppose the MS patch breaks one of your applications. > Suppose I'd be reading your ra

Re: [Full-disclosure] what we REALLY learned from WMF

2006-01-05 Thread Niek
On 1/5/2006 11:07 PM +0100, James Lay wrote: I didn't learn anything new...just confirmed what I've thought all along...MS's Security sucks (who in their RIGHT MIND would have an image file reader able to execute code???), and that the REAL hero's are people in the security sector like here that

Re: [Full-disclosure] what we REALLY learned from WMF

2006-01-05 Thread James Lay
On Thu, 05 Jan 2006 23:53:45 +0200 Gadi Evron <[EMAIL PROTECTED]> wrote: > What we really learn from this all WMF "thingie", is that when > Microsoft wants to, it can. > > Microsoft released the WMF patch ahead of schedule > ( http://blogs.securiteam.com/index.php/archives/181 ) > > Yep, THEY re

[Full-disclosure] what we REALLY learned from WMF

2006-01-05 Thread Gadi Evron
What we really learn from this all WMF "thingie", is that when Microsoft wants to, it can. Microsoft released the WMF patch ahead of schedule ( http://blogs.securiteam.com/index.php/archives/181 ) Yep, THEY released the PATCH ahead of schedule. What does that teach us? There are a few options