Feeds

Netscape blows off new vuln warning

Do not pass Go; do not collect $1000

  • alert
  • submit to reddit

The smart choice: opportunity from uncertainty

A recent advisory from GreyMagic Software demonstrates a minor file access vulnerability in Netscape and Mozilla for Windows, very much like the recent one affecting MS Internet Exploder.

No doubt it will be patched soon and without great difficulty. The potential for malicious exploitation is modest, and the installed user base, being a fraction of IE's, makes this item marginally newsworthy. Only Netscape has taken steps to make it particularly interesting by ostentatiously ignoring GreyMagic's attempts to elicit a response, and to claim the $1000 prize they believe they're entitled to according to the terms of the Netscape Bug Bounty program.

According to Netscape, "this bounty applies to only those bugs that are found in Netscape 6 or Netscape Communicator (excluding 3rd party software), and that allow the attacker to run unsafe code on the user's system and/or access files on the user's system."

This particular discovery would seem to satisfy those conditions. But GreyMagic says they contacted Netscape on 24 April through the CGI form on the Bug Bounty Web site and via e-mail memos to security@netscape.com and secure@netscape.com and have heard nothing in reply.

"By completely disregarding our post Netscape has earned themselves $1000 and lost any credibility they might have had. The money is irrelevant, but using such a con to attract researchers into disclosing bugs to Netscape is extremely unprofessional," GreyMagic says.

"Netscape is conning the security community by offering an imaginary $1000 for bugs such as the one we've published."

Or they're using it as a clever means to delay disclosure.

Netscape gives itself some wiggle room, declaring that a qualifying stuff-up must not be "a trivial threat (as judged by Netscape engineers fixing the bug)."

Trivial is a funny word which can mean almost anything. You can look at the script:

var oXML=new XMLHttpRequest();
oXML.open("GET","getFile.asp",false);
oXML.send(null);
alert(oXML.responseText);

and say, of course -- duh! -- and you might say it was trivial following comedian Rick Green's worthy dictum, "I've got a simple rule: if I can do it, it's not art."

But then if it really was trivial, we'd have heard of it long ago. So let's say it's simple, which is entirely different. Personally, I don't think Netscape gets to wiggle out of this with the triviality clause.

As for Mozilla, things have gone somewhat differently. Bugzilla was contacted only hours ago; and while the post was quickly yanked from public view, a Netscape engineer caught it, confirmed it, and has since contacted GMS.

So there might be some hope of claiming that whopping $1000 reward after all. The indictment here may not be of Netscape's response to vulnerabilities, but of the dead ends bug reporters are confronted with.

Yet notification is half the battle. If Netscape can't get that much right, we may have to consider dropping them from the Trustworthy Computing Pantheon. ®

Securing Web Applications Made Simple and Scalable

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.