On Wed, 23 Feb 2000, Jim Paris wrote: > > BigMailBox.com was notified of the problem on Fri, 11 Feb 2000. After > > additional testing and verification, staff of BigMailBox.com patched > > the vulnerability on Mon, 14 Feb 2000. > ... > > Contact BigMailBox and complain about shoddy and insecure e-mail access. > > They patched the hole in 3 days (over a weekend, no less!). I don't > think that demands mass complaints about "shoddy and insecure" > e-mail. They seem to have been very responsible about the bug. The fix did not occur three days following notification. After posting our notice, we were notified by another Bugtraq subscriber that said vulnerability had been previously posted to Bugtraq over a *month* ago. (Yeah, we missed that, but so did BigMailBox.) .c
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:36:57 PDT