Secunia Advisory SA38608

This smacks of hoax.

I’m an ordinary old lady, who uses Firefox, Chrome, the Sea Monkey, and Internet Explorer in the order listed. I am also a passionate advocate of Secunia’s PSI. I feel betrayed. Brace yourselves. I’m going to tell you why.

Reporting a software vulnerability directly to it’s open-source creator–namely, Mozilla–is commonly accepted as best practice by today’s internet community. This is widely understood to be responsible disclosure, because it minimizes exposure of the end user to malicious attacks while Mozilla is developing, testing, and deploying a patch.

I dare speculate that most ordinary computer users believe the positive verification of the alleged security flaw in Firefox 3.x means both Secunia and the Russian blackhatter have knowledge of either
1.) The steps required to reproduce a specific exploit, or
2.) Specific proof of the concept that supports exploitation. (A convincing demonstration which, in principle, clearly shows how Firefox 3.x can be compromised without constructing a complete, functioning code for that purpose.)

The publication of a security advisory, assignment of a highly critical vulnerability rating to that advisory, and Secunia’s widely respected reputation–all combine to inform belief that the alleged flaw is real. On the other hand, Mozilla’s own security researchers indicate the nature of the alleged exploitable flaw is unknown to them. They have no facts to act upon–namely, neither the steps required to reproduce the alleged exploit, nor a proof-of-concept pointing to an exploitable coding error. I do not doubt Mozilla’s word, because very few software vendors, if any, can claim to exceed Mozilla’s dedication to writing secure code, and Mozilla’s open record of diligence in fixing security holes in a timely manner.

For anyone wishing to be well-informed in this matter, the following link will take you to a story reported by Brian Krebs and posted to his blog, 11 January, 2010:

http://www.krebsonsecurity.com/2010/01/firm-to-release-database-web-server-0days/

I am shocked by those, who believe the open-source community should pay thousands of dollars in extortion for software that might tell them if the Russian blackhatter with an axe to grind has discovered a zero-day exploit in Firefox, or not.

Secunia appears to have unwittingly supported a flagrant and unprecedented attack on open-source software, which could do great harm to the free and open internet in the future. Secunia needs to review its corporate intelligence-gathering policies and make adjustments to reduce the probability of another shameful stalemate like this one.

Anyone–whether he lives in Moscow, Copenhagen, or elsewhere–who seeks recognition as a source of reliable vulnerability intelligence, and who possesses evidence that the Firefox 3.x code contains a security hole defined by the broad brush of SA38608, has an ethical obligation to slip the proof under Mozilla’s doormat, or to withdraw the accusation. To repeat: It is called responsible disclosure. Anything less is unacceptable.