RE: Web Site Vulnerabilities

Your course of action is dictated by the amount of liability and confidentiality you have assumed.

If you have signed an NDA then there is little you can do after explaining the issue.  If there is no NDA and you feel confident
that you are correct you can inform them that you will go public with your information in a reasonable period of time.  

If you choose to go public, then allow them the opportunity to correct the issue before going public, and make sure that there is
nothing (i.e. DMCA and such) which could be used to assign legal liability to you.

Realistically speaking though, if they don't believe it is an issue, and you have tried to educate them, then you have done the best
you can.  Sometimes organizations have to put their hand in the fire before they understand what it feels like to get burned.

Yvan

-----Original Message-----
From: Cory Foy [mailto:[email protected]] 
Sent: Monday, October 25, 2004 6:43 PM
To: [email protected]
Subject: Web Site Vulnerabilities

Recently I came across two web sites that had various vulnerabilities. 
One was subject to a basic SQL injection attack to log in to their customer side, and the other was displaying ASP code in the page
that listed not only various function definitions, but login, URL and passwords (including sa) for their database.

In both cases I have working relationships with the managers and sent an email off to them. In both instances the managers replied
that they were aware of the issues and the SQL injection attacks, but didn't feel it was a priority to fix.

On one of the sites I could understand. It is basically a portal to publically available information, and no secure information is
stored in their system. The second was on a machine that passed authentication information to a remote banking site and though I
don't know, would surmise that it might be possible to jump off of it if compromised.

Have we really become so lax in our thinking that security issues such as these can be shrugged off? Don't get me wrong, I'm not
suggesting that either of these cases should kill all development and immediately fix it (though in the case of SQL injection
attacks it is so easy to fix...). But some response should at least be justified (for example, with the banking site, whose vuln is
still present). Or is it fine to postpone worrying about problems such as these if you don't think they will have an impact?

Cory