The only model that makes no sense to me is the altruistic model. The vendor wants the researcher to do his code review for free and that doesn't quite fly. They are profiting from the vulnerability information but they don't want to pay for it. |
The vulnerability still exists in Internet Explorer in that it's very lenient in how it pulls CSS, but right now nobody is publishing a way that it can be leveraged to do something useful. That's not to say that somebody won't find a way. I'm sure somebody will come up with a creative way to leverage it to do something evil. |
There is some irony there. |
There's always code reuse in development, which is a good thing. No one writes an entire application from scratch. But if you're using someone else's code, you're relying on the security of that code. Developers need to apply the same level of security testing to those shared pieces as they do to their own code. |
This is relatively easy to exploit. It takes some degree of social engineering -- the attacker would have to draw people to a malicious Web site -- but after that, there's no further intervention required. An attacker could leverage this to write to a file on the hard drive. And once you can write to a person's machine, you have full control. |
We applaud Compass Group North America for its leadership. Its commitment, and a similar decision by major food retailer Wal-Mart, is a significant step toward transformation of the seafood market in ways that support sustainable fisheries and healthy ocean ecosystems. |
We pay people directly for their submissions, and then we also have various programs to reward our loyal contributors and keep them working with us. This is our latest effort to further reward them. |
We want to use [the quarterly hacking challenge] to inspire our contributors to target their research in specific areas. We have a lot of clients running Microsoft products and they want to be protected from critical vulnerabilities. |
We're not aware of any public exploit code for it at this time. |