Showing posts with label microsoft. Show all posts
Showing posts with label microsoft. Show all posts

Feb 20, 2008

No credit = exploit

Because Microsoft refused to credit the researcher who reported MS08-011/CVE-2008-0108 a corresponding exploit was publicly released. A person or group going by the name chujwamwdupe chujwamwdupe posted the exploit to Full-disclosure.

Unfortunately, Microsoft has refused to credit you using the name you requested.

I think there's a mixup in the iDefense Labs advisory, unless sillypea is chujwamwdupe. The CREDIT section says:
This vulnerability was reported to VeriSign iDefense by sillypea.

The acknowledgments on the Microsoft bulletin says:
VeriSign iDefense VCP for reporting the Microsoft Works Converter Overrun Vulnerability (CVE-2008-0108).

Microsoft flagged the pseudonym as offensive. This is similar to what happened when Manuel Santamarina Suarez aka FistFuXXer reported MS06-059/CVE-2006-2387. They had to drop FistFuXXer in the bulletin.

I wonder what does the polish word chujwamwdupe really mean ?