Date: Wed, 10 Oct 2012 22:39:22 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Fwd: IPv6 DOS vulnerabilities Hi, Thanks for posting this, Marc. On Wed, Oct 10, 2012 at 06:55:07PM +0200, Marc Heuse wrote: > (I am sitting on this for over a half year now, sorry for that) Just to clarify: this "half a year" delay occurred before Marc notified the distros list, which he did on September 20. (I was not aware of Marc's work on this before that date either.) Thus, as far as the distros list is concerned, the issues were reported to distro vendors and embargoed for 20 days, which is a slight violation of the list's policy (14 to 19 days max, depending on day of week). I apologize for this. I did not insist on Marc disclosing the issues publicly sooner than he wanted to for reasons similar to what we had with hashDoS last year (just a DoS, which the researchers wanted to disclose at a certain con), although I did remind him and recommend posting to oss-security sooner, so that I wouldn't have to apologize. ;-) It appears that vendors did not care to patch mere IPv6 DoSes promptly enough anyway, so the embargo did not help. Notifying the distros list closer to the intended public disclosure date would be more appropriate - it would reduce the window of partial exposure. Not providing any advance notification would be even better in this specific case (since apparently no action was taken anyway), but this was impossible to know reliably in advance. Thanks again, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ