Michael Sutton Code Quotations

The only model that makes no sense to me is the altruistic model. The vendor wants the researcher to do his code review for free and that doesn't quite fly. They are profiting from the vulnerability information but they don't want to pay for it.

I would certainly recommend that users implement the vendor workarounds until a patch is made available. We feel that exploit code can and will be created.

Patching is very urgent. We expect public exploit code to become available, especially for the MSDTC issue.

Patching is very urgent, ... We expect public exploit code to become available, especially for the MSDTC issue.

We're not aware of any public exploit code for it at this time.

Even though Windows Media Player is not something generally used to render images, it has the capability of doing that. It's not difficult to create a Web page that uses Windows Media Player to display an image instead of the default application. I think it's a ripe target for exploitation if we see public exploit code for it.

There's always code reuse in development, which is a good thing. No one writes an entire application from scratch. But if you're using someone else's code, you're relying on the security of that code. Developers need to apply the same level of security testing to those shared pieces as they do to their own code.

It seems like there is some flaky code in portions of the libraries that handle the WMF files. It wouldn't surprise me if we see more vulnerabilities emerge, which I am sure will be followed by more media coverage.