RE: Details of Sybase ASE bugs withheld

["Evans, Arian" <Arian.Evans () fishnetsecurity com>]

> -----Original Message-----
> From: Jay Libove [mailto:libove () felines org] 

> I think Simple Nomad wrote an excellent analysis of the problem of a COTS 
> vendor (in this case, Sybase) "requesting" (make legal threats) against a 
> security research firm to not disclose the details of a discovered vulnerability.

I second your conclusion to Simple Nomad's analysis. I unfortunately have
had and continue to have the same experience with vendors. Some that are
vendors of security products and I honestly expected to be positive. </naïve>

> To that end, I have encouraged my employer to perform some commercial 
> activism by contacting the commercial product vendor, as a concerned 
> customer, and suggesting that we disapprove of their policy of using legal 
> threats to keep the vulnerability details quiet. I have further suggested 
> that we should copy such notice to our lobbyists / elected representatives.

Excellent. If everyone on these lists that is a licensed/paying user of Sybase
products contacted Sybase to express their concern and displeasure, their
stance would quickly change. Let them know you'll vote with your dollars.

Anyone remember when someone published Carly the HP CEO's email address
to a certain list and the 1,000's of emails she got over the Snosoft lawsuit?
(I think it was Snosoft, wasn't it?)

HP changed their tune really fast and claimed "it was all a misunderstanding".

How about a little noise from the community. NGS should drop a name or an
email address if they find they cannot make progress on this.

Also, where are the clueless media articles about this? Where are the media
folks for that matter? I know you guys are reading BT.

Stop writing about Microsoft-funded studies analyzing Linux security
and write about some real information.

Arian Evans
Sr. Security Engineer
FishNet Security

Phone:  816.421.6611
Toll Free:  888.732.9406
Fax:  816.421.6677

http://www.fishnetsecurity.com



The information transmitted in this e-mail is intended only for the addressee and may contain confidential and/or 
privileged material. 
Any interception, review, retransmission, dissemination, or other use of, or taking of any action upon this information 
by persons or entities
other than the intended recipient is prohibited by law and may subject them to criminal or civil liability. If you 
received this communication 
in error, please contact us immediately at 816.421.6611, and delete the communication from any computer or network 
system.