Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

guest · Feb 7, 2019

Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma
February 7, 2019
https://www.securityweek.com/zero-day-vulnerability-highlights-responsible-disclosure-dilemma

A zero-day vulnerability found in a video-conferencing system and responsibly disclosed led to the response, "Our developers are aware of some known vulnerabilities with the systems, development for these devices has slowed significantly as they are End of Life. For devices that are still under support, we may target future releases."

This left the vulnerability finder -- Trustwave SpiderLabs' researcher Simon Kenin -- with a quandary: make public the vulnerability so that users would be aware of the threat and attackers might use it, or just sit on it.
The vulnerability, amounting to multiple command injection flaws, is trivial to exploit and was found in all versions of four Lifesize products: Team, Room, Passport and Networker.

[...] Kenin blogged he "could achieve root privileges on the Lifesize product's system and have full persistence on the device and its underlying corporate network.
He wrote a full python PoC exploit and provided it with his disclosure to Lifesize in November 2018.
He had no reply from Lifesize. In January 2019 he tried again -- and this is when he was told there would be no fix.
Click to expand...

"It is always a dilemma when you go public with an advisory after a responsible disclosure process that does not result in a fix," he wrote.

Kenin decided to publish his findings (Advisory TWSL2019-001), but withhold publishing the exploit for two weeks (it will be appended to the advisory).
Click to expand...

Log in or Sign up

Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

guest Guest

Log in or Sign up

Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

guest Guest

Useful Searches