Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] ZDI-07-006: Citrix Metaframe Presentation Server P

from [Jason Areff] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] ZDI-07-006: Citrix Metaframe Presentation Server Print Provider Buffer Overflow Vulnerability
Date: Wed, 24 Jan 2007 17:35:54 -0600
On 1/24/07, Christian Kujau <lists@nerdbynature.de> wrote: 

On Wed, 24 Jan 2007, zdi-disclosures@3com.com wrote:
> -- Disclosure Timeline:
> 2005.07.07 - Pre-exiting Digital Vaccine released to TippingPoint
> customers
> 2006.10.02 - Vulnerability reported to vendor
> 2007.01.24 - Coordinated public release of advisory

out of curiosity: why took it 1+ year to report this vulneralbility to
the vendor?


Where do you see 1+ year? *Pre-existing* means there already existed a
"vaccine" that blocked vulnerabilities of this type released in '05. This
does not necessarily mean that was when ZDI received the bug submission. So
it was reported to the vendor in October and released to the public in
January... 4 months is not an outstanding patch time.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] [CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities, Williams, James K
Next by Date:  Re: [Full-disclosure] Secunia Research: NCTsoft Products NCTAudioFile2 ActiveX Control Buffer Overflow, Secunia Research
Previous by Thread:  Re: [Full-disclosure] ZDI-07-006: Citrix Metaframe Presentation Server Print Provider Buffer Overflow Vulnerability, Christian Kujau
Next by Thread:  Re: [Full-disclosure] ZDI-07-006: Citrix Metaframe Presentation Server Print Provider Buffer Overflow Vulnerability, Col
Indexes:  [Date] [Thread] [Top] [All Lists]