Корпорация Oracle выпустила критический патч к Weblogic. Это произошло примерно через две недели после публикации подробностей уязвимости, позволяющей запускать на сервере произвольные команды без аутентификации. В качестве примера был показан запуск программы ping.exe после подключения к серверу Weblogic при помощи openssl. Автор публикации - Евгений Легеров, генеральный директор российской компании Intevydis, специализирующейся на вопросах безопасности.
Вот эта публикация: http://intevydis.blogspot.com/2010/01/oracle-weblogic-1032-node-manager-fun.html
Кроме того The Register сообщяет, что в своей более ранней публикации Легеров критикует практику так называемого «ответственного раскрытия» (responsible disclosure) практикуемую многими корпорациями. Легеров приравнивает такую практику к бесплатному QA по требованию. Вот что он написал:
I would like to highlight our position to so called responsible disclosure policy as we keep receiving emails from software vendors: “”" According to http://intevydis.com/vd-list.shtml it appears that you’ve discovered security vulnerabilities in our XYZ product. We would like to fix this as soon as possible so please send us immediately the vulnerability details along with a proof of concept code to reproduce the vulnerability. If you do not have the details we respectfully request you remove the advisory to alleviate undue concern for our mutual customers…
It is an established practice among all security researchers to give vendors fair advance notice with a full description prior to publishing exploits. One month is the usual term that researchers grant vendors. “”"
Introduction:
We are small Moscow based company working in the field of security.
Besides writing complex tools to test software we are providing pentesting and code review services. We are also known as the developers of VulnDisco add-on which has to our knowledge the richest set of unpublished vulnerabilities in many software products.
We are developing and using our testing tools for many years and VulnDisco (and upcoming DBJIT product) is the proof of their effectiveness.
Now back to interesting part. During the time our position to responsible disclosure policy has been evolved and now we do not support it. Because it is enforced by vendors and it allows vendors to exploit security researches to do QA work for free.
You – ABCD company, making N millions per year selling your buggy XYZ product all over the world, why are you asking to give the results of the hard work during many years for free? Instead of wasting your and our time would not it be better to allocate resources to enforce good coding practices for all your amateur software developers?
Перемещено maxcom из Security
