OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Full-disclosure] Secunia published adviso withoutrespectingrelease date !

From: Xavier Beaudouin (kiwioav.net)
Date: Sat Jul 16 2005 - 04:17:50 CDT


Le 16 juil. 05 à 03:59, Jerome Athias a écrit :

> 2 things i remind myself...
>
> 1) http://seclists.org/lists/vulndiscuss/2004/Dec/0006.html

Yes. I received this one. But I still don't agree that Secunia didn't
take the time to inform The Caudium Group *before* sending this
"advisory" to security lists.

This is _not_ fair and positivement a bad way to be *respected* on
security advisory.

This also the reason why we decided (we = caudium group) to close bug
tracker at sourceforge to avoid false information to be sent.

Usualy the idea is :

bug/security problems found -> draft of advisory is sent to
developpers to get more accurate information -> time to make a fix ->
advisory is sent

Secunia has just taken a bug from our tracker *without* telling the
Caudium Group that are taking this for makeing a advisory, and just
sent it to security lists with _false_ information.

I still consider that this is half done work and they are not nice
people when they make advisory.

So because of that half done work, all Caudium Group developpers now
don't trust anymore Secunia. I am sorry for them, but this is the way
they make the advisory without contacting authors that give us this
situation.

> 2) This is an answer of Thomas before a disclosure of some vuln
> that Secunia found "at the same time" :
>
> 10/09/2004 19:40
>
> Re: OpenOffice World-Readable Temporary Files Disclose Files to
> Local Users
>
> Hi Jérôme,
>
> This issue was originally discovered by Secunia on 16th August and
> reported to the vendors.
>
> Please do not forward to anyone else. The various vendors well release
> updates on Wednesday in a co-ordinated disclosure.
>
> Kind regards,

They didn't get so smarter with us. We still don't accept this fact.
If they where so smart we still trust them. They were not so they are
their own victim of their half work for Caudium group advisory.

/Xavier

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/