Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: Microsoft Internet Explorer - Crash on adding sites to restricted zone (05/28/2005)
From: Steven M. Christey (coleymitre.org)
Date: Tue May 31 2005 - 21:07:57 CDT
Many browser crashes can be directly triggered by an attacker from a
malicious web page, which makes a reasonable argument for calling such
problems a "vulnerability" or some other term that implies some impact
on confidentiality, integrity, or availability.
However, as described, this particular issue seems to require manual
steps on the user's part, and the attacker has little or no role in
the "exploit," barring social engineering.
There seems to be an implicit agreement that self-inflicted DoSes
don't cross any security boundaries and thus are not security
The question, then, becomes whether this particular issue is more of a
"bug" than a "vulnerability" ? If it's a "vulnerability," then how do
you distinguish this from other problems that are just "bugs" ?