4 ms·
Here is the timeline if you're interested - 14 days from contact to publication: 2013-01-10: Sending advisory and proof of concept exploit via encrypted channe
by darkarmani 14y ago
Here is the timeline if you're interested - 14 days from contact to publication:
2013-01-10: Sending advisory and proof of concept exploit via encrypted channel.
2013-01-14: Vendor confirms receipt and provides BNSEC IDs.
2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule.
2013-01-21: Conference call - discussing implemented solutions.
2013-01-23: Barracuda Networks releases alert & secdef
2013-01-24: SEC Consult releases coordinated security advisory.
- jlgaddis 14y agoFrom the post to f-d: > 2012-11-29: Contacting vendor. > 2012-11-29: Sending advisory and proof of concept exploit via encrypted channel.
- darkarmani 14y agoOops. You are completely correct. I posted the timeline for the follow-up advisory! And it's too late to edit.
- darkarmani 14y agoOops! This is the correct timeline (the other one is a followup advisory): 2012-11-29: Contacting vendor. 2012-11-29: Sending advisory and proof of concept exploit via encrypted channel. 2012-12-04: Vendor confirms receipt and provides BNSEC IDs. 2012-12-05: Requesting further coordination (conference call). 2012-12-13: Sending reminder regarding SEC Consult disclosure policy. 2012-12-15: Vendor responds - arranging conference call. 2012-12-18: Conference call: Addressing the risks the discovered vulnerabilities pose to customers and release schedule. 2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule. 2013-01-21: Conference call - discussing implemented solutions. 2013-01-21: Vendor provides information about some questions which came up. 2013-01-22: Asking for definitive listing of affected appliances. 2013-01-23: Barracuda Networks releases alert & secdef 2013-01-24: SEC Consult releases coordinated security advisory.