How to Report a Security Vulnerability to Microsoft

[Kevin]

On a related note, today we ran into (headfirst) a bug in Internet
Explorer with the processing of a AutoProxy scripts (Proxy Automatic
Configuration aka "PAC", a specialized subset of javascript to make
client-side web proxy routing decisions).

Eventually I isolated the problem to a broken implementation of
dnsDomainIs() in Internet Explorer, so I decided to do the right thing
and report the bug to Microsoft. This isn't a higly critical security
flaw, so I hunted around microsoft.com and eventually found the page
on bug reporting: http://support.microsoft.com/gp/contactbug

The page states "If you think you have found a bug in a Microsoft
product, contact our Microsoft Product Support Services department.
(800) MICROSOFT (642-7676)". No email address, no web form, just a
phone number.

So I call this number, and after five minutes of sitting through IVR
menus, I finally reach a live human. She asks for my name and phone
number, and as soon as I mention that I am reporting a bug in Internet
Explorer, says she will transfer my call.

At that point I get fifteen seconds of music on hold, followed by dead
air. That was a half hour ago.


Kevin Kadow

(P.S. Yes, this is definitely a bug in MSIE -- every other browser
I've tried handles dnsDomainIs() correctly, the sole exception is
MSIE).
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Gary O'leary-Steele]

Hi,

Im also trying to report a vulnerability to Microsoft but the site they
provide is broken

when i fill out and send

https://www.microsoft.com/technet/security/bulletin/alertus.aspx

I get:

We’re sorry, but we were unable to service your request. You may wish to
choose from the links below for information about Microsoft products and
services.





-----Original Message-----
From: full-disclosure-***@lists.grok.org.uk
[mailto:full-disclosure-***@lists.grok.org.uk]On Behalf Of Kevin
Sent: 27 April 2005 00:11
To: Microsoft Security Response Center
Cc: full-***@lists.grok.org.uk; ***@listserv.ntbugtraq.com
Subject: Re: [Full-disclosure] How to Report a Security Vulnerability
toMicrosoft


On a related note, today we ran into (headfirst) a bug in Internet
Explorer with the processing of a AutoProxy scripts (Proxy Automatic
Configuration aka "PAC", a specialized subset of javascript to make
client-side web proxy routing decisions).

Eventually I isolated the problem to a broken implementation of
dnsDomainIs() in Internet Explorer, so I decided to do the right thing
and report the bug to Microsoft. This isn't a higly critical security
flaw, so I hunted around microsoft.com and eventually found the page
on bug reporting: http://support.microsoft.com/gp/contactbug

The page states "If you think you have found a bug in a Microsoft
product, contact our Microsoft Product Support Services department.
(800) MICROSOFT (642-7676)". No email address, no web form, just a
phone number.

So I call this number, and after five minutes of sitting through IVR
menus, I finally reach a live human. She asks for my name and phone
number, and as soon as I mention that I am reporting a bug in Internet
Explorer, says she will transfer my call.

At that point I get fifteen seconds of music on hold, followed by dead
air. That was a half hour ago.


Kevin Kadow

(P.S. Yes, this is definitely a bug in MSIE -- every other browser
I've tried handles dnsDomainIs() correctly, the sole exception is
MSIE).
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


******************************************************************************************************************************************************************
NEW: Sec-1 Hacking Training - Learn to breach network security to further your knowledge and protect your network http://www.sec-1.com/applied_hacking_course.html
******************************************************************************************************************************************************************
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[[e-mail]]

Post by Gary O'leary-Steele
Hi,
Im also trying to report a vulnerability to Microsoft but the site they
provide is broken
when i fill out and send
https://www.microsoft.com/technet/security/bulletin/alertus.aspx
We’re sorry, but we were unable to service your request. You may wish to
choose from the links below for information about Microsoft products and
services.
-----Original Message-----
Sent: 27 April 2005 00:11
To: Microsoft Security Response Center
Subject: Re: [Full-disclosure] How to Report a Security Vulnerability
toMicrosoft
On a related note, today we ran into (headfirst) a bug in Internet
Explorer with the processing of a AutoProxy scripts (Proxy Automatic
Configuration aka "PAC", a specialized subset of javascript to make
client-side web proxy routing decisions).
Eventually I isolated the problem to a broken implementation of
dnsDomainIs() in Internet Explorer, so I decided to do the right thing
and report the bug to Microsoft. This isn't a higly critical security
flaw, so I hunted around microsoft.com and eventually found the page
on bug reporting: http://support.microsoft.com/gp/contactbug
The page states "If you think you have found a bug in a Microsoft
product, contact our Microsoft Product Support Services department.
(800) MICROSOFT (642-7676)". No email address, no web form, just a
phone number.
So I call this number, and after five minutes of sitting through IVR
menus, I finally reach a live human. She asks for my name and phone
number, and as soon as I mention that I am reporting a bug in Internet
Explorer, says she will transfer my call.
At that point I get fifteen seconds of music on hold, followed by dead
air. That was a half hour ago.
Kevin Kadow
(P.S. Yes, this is definitely a bug in MSIE -- every other browser
I've tried handles dnsDomainIs() correctly, the sole exception is
MSIE).
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
******************************************************************************************************************************************************************
NEW: Sec-1 Hacking Training - Learn to breach network security to further your knowledge and protect your network http://www.sec-1.com/applied_hacking_course.html
******************************************************************************************************************************************************************
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Kevin]

I tried the form, and then later sent email directly to the contact
address above.

Within minutes of sending email I received a form letter response with
a problem ID, and then a few minutes later received a second message
citing the same problem ID and including the information from my
original web form submission.

This suggests that both contact methods are functional and likely go
to the same queue.


Kevin Kadow
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[xyberpix]

Hey All,

Couple of questions on reporting vulnerabilities:

1) Is there a damn template somewhere that can be used, as I'm pretty sure
there was at one point, and I can't seem to find it? If so, could someone
please let me know where this is located?

2) Is it worth sending something out like a cookie storing usernames and
passwords in clear text for a major vendor's piece of software?

3) What's the correct procedure to go through reporting a vulnerability?

If all of these questions can be answered with one simple link, can
someone please paste it, as I really need to know this info soon.

TIA

xyberpix

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Rob]

Post by xyberpix
Hey All,
1) Is there a damn template somewhere that can be used, as I'm pretty sure
there was at one point, and I can't seem to find it? If so, could someone
please let me know where this is located?
2) Is it worth sending something out like a cookie storing usernames and
passwords in clear text for a major vendor's piece of software?
3) What's the correct procedure to go through reporting a vulnerability?
If all of these questions can be answered with one simple link, can
someone please paste it, as I really need to know this info soon.
TIA
xyberpix

Good question, I looked a little and couldn't find a simple link. I like the slightly more narrative and editorial style of our own
class 101 Jr. Researcher (you can search the FD archives for examples from them) but in general, I think we can make two lists (I'll
label them to ease any further discussion). I'll start, but I'm not any kind of authority in the field:

======================================================
1) Some considerations regarding reporting a vulnerability:

a) Think about whether or not to report the vulnerability - some cases exist where people have been prosecuted and/or become a
"person of intrst" for reporting vulnerabilities (I am sure will have opinions about this)

b) Decide what level of anonymity to use when reporting (see a above)

c) Decide whether to notify the vendor first and how much effort and how much time to wait before exposing the vulnerability further.
As has been discussed here recently, some people feel it is a moral imperative to give vendors at least a couple weeks before further
disclosure. Other say screw the vendors, it is solely the spectre of full disclosure that keeps them honest at all.

d) If and/or when you decide to disclose, choose which lists or other venues to use for your disclosure.
Some don't like the freestyle atmosphere here at FD, others post to several lists simultaneously.

e) Check the CVE http://www.cve.mitre.org/ and other lists/databases to see if your "new" vulnerability is already listed or
reported. See the FD list archives for numerous examples of re-runs. (Probably not applicable in your current case)

f) Decide whether to include POC exploit code and/or methodology to reproduce vulnerability. Some people publish reports without
these details for various reasons.

g) Decide what, if any restrictions to put on exploit code and/or other parts of the report. Some people do this because they want to
control what security companies put in their databases and lists. (See FD archives for examples)

==============================================
2) Things to Include in a Vulnerability Report:
(Hopefully others will chime in on these)

a) Overview/Summary - Nice but probably not necessary

b) Your Disclosure ID (If you track them and to prevent confusion for reports on the same product)

c) Date of Disclosure

d) Product Publisher and Product Name (or site) and link

e) List of tested versions, affected/at risk versions and patched/unaffected versions

f) Your estimate of Severity/Risk

g) Local or Remote Exploit (People have non-standard ways of reporting severity and local/remote/escalation risk)

h) General Description of the problem and/or the methods used in the process of working on the vulnerability.

i) Method of exposing vulnerability and/or POC code (Depending on your considerations from part 1)

j) Proposed fixes and/or patches

k) References - For instance, if you are discussing an obscure DNS vulnerability and you based some of your code on the ideas of Dan
Kaminsky, you might reference http://www.doxpara.com/

l) Timeline - It is important (again using my moral compass) to give proper credit to all parties who helped with topics covered.
Some unscrupulous security "professionals" have, in the past, exaggerated their role in discovering vulnerabilities - which tends to
piss off everyone who knows better, while the media at large tends to remain oblivious. Also, people like to document the timeline if
the vendor never responded and several attempts were made to contact them and report the vulnerability/exposure.

m) Credit & Disclaimers - In this section make clear any restrictions you wish to try to impose on the information and/or code.

n) Greets, Props and Shouts - Some people like to acknowledge others in the field.

m) Misc Notes that don't fit other headings

===========================================

That is all I can think of right now. Clear text user/password cookies are probably worth reporting (at least to the vendor) since
some unaware user may login at a library or other public machine and expose their info (even if the connection uses SSL) - as one
example of the multitude of ways the info could be exposed. If you can't find a way to report the vulnerability on their website, try
***@company.blah or ***@company.blah since RFC 2412 says they are supposed to have those as working addresses.

Good Luck.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[mikx]

Post by xyberpix
If all of these questions can be answered with one simple link, can
someone please paste it, as I really need to know this info soon.

http://www.oisafety.com/guidelines/secresp.html

A detailed guideline used by major companies like Microsoft, Network
Associates, Oracle, etc

Kind regards,
Michael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[xyberpix]

Hi Guys,

Thanks a load for the feedback on this one.
I really appreciate it!
I think that I've got enough to go on now, I'll let you know how things
progress.

xyberpix

Post by mikx

Post by xyberpix
If all of these questions can be answered with one simple link, can
someone please paste it, as I really need to know this info soon.

http://www.oisafety.com/guidelines/secresp.html
A detailed guideline used by major companies like Microsoft, Network
Associates, Oracle, etc
Kind regards,
Michael

[Morning Wood]

you are looking for this...
http://www.oisafety.org/guidelines/Guidelines%20for%20Security%20Vulnerability%20Reporting%20and%20Response%20V2.0.pdf

http://www.oisafety.org

cheers,
Donnie Werner

Post by xyberpix
Hey All,
1) Is there a damn template somewhere that can be used, as I'm pretty sure
there was at one point, and I can't seem to find it? If so, could someone
please let me know where this is located?
2) Is it worth sending something out like a cookie storing usernames and
passwords in clear text for a major vendor's piece of software?
3) What's the correct procedure to go through reporting a vulnerability?
If all of these questions can be answered with one simple link, can
someone please paste it, as I really need to know this info soon.
TIA
xyberpix

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Georgi Guninski]

Post by Kevin
So I call this number, and after five minutes of sitting through IVR
menus, I finally reach a live human. She asks for my name and phone
number, and as soon as I mention that I am reporting a bug in Internet
Explorer, says she will transfer my call.
At that point I get fifteen seconds of music on hold, followed by dead
air. That was a half hour ago.

according to http://www.pcmag.com/article2/0,4149,1210067,00.asp
"Magic Number: 30 Billion" "Gates said that 5 percent of Windows machines
crash, on average, twice daily. ..... 24.5 million reports a day accumulate
in Redmond -- nearly 9 billion per year."

imagine you have 9 billion *free* crash reports -- will you be interested in
chatting about bugs on the phone?

which reminds me of the joke about the gynecologist after a hard day work and
the woman offering him to show him some parts of her body for a few bucks.

[Tatercrispies]

To be fair, I believe that number includes application crashes. Every
time my Firefox, Open Office, or Quicktime crashes, yes, Microsoft
receives an error report.

Post by Georgi Guninski
according to http://www.pcmag.com/article2/0,4149,1210067,00.asp
"Magic Number: 30 Billion" "Gates said that 5 percent of Windows machines
crash, on average, twice daily. ..... 24.5 million reports a day accumulate
in Redmond -- nearly 9 billion per year."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Georgi Guninski]

i would like m$ to officially confirm they are collecting crashes and
confidential information from third parties warez.

because i am sure my humble application c:\fsckb11.EXE does not send crash
reports to m$ in the cases when it crashes.
--
where do you want bill gates to go today?

Post by Tatercrispies
To be fair, I believe that number includes application crashes. Every
time my Firefox, Open Office, or Quicktime crashes, yes, Microsoft
receives an error report.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Tatercrispies]

What do you want confirmation about? It's not a big secret when the
big-assed dialog box pops up and asks if you'd like to submit crash
data to Microsoft's servers. (sorry, M$'$ $ervers)

https://winqual.microsoft.com/help/wer_help/dev.aspx

Post by Georgi Guninski
i would like m$ to officially confirm they are collecting crashes and
confidential information from third parties warez.
because i am sure my humble application c:\fsckb11.EXE does not send crash
reports to m$ in the cases when it crashes.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[[e-mail]]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Who has access to error report data

Microsoft employees, contractors and vendors who have a business need
to use the error report data are provided access. If the error report
indicates that a third-party product is involved, Microsoft may send
the data to the vendor of that product, who may in turn send the data
to sub-vendors and partners.

http://oca.microsoft.com/en/dcp20.asp

Post by Tatercrispies
What do you want confirmation about? It's not a big secret when the
big-assed dialog box pops up and asks if you'd like to submit
crash data to Microsoft's servers. (sorry, M$'$ $ervers)
https://winqual.microsoft.com/help/wer_help/dev.aspx

Post by Georgi Guninski
i would like m$ to officially confirm they are collecting crashes
and confidential information from third parties warez.
because i am sure my humble application c:\fsckb11.EXE does not
send crash reports to m$ in the cases when it crashes.

_______________________________________________ Full-Disclosure -
http://lists.grok.org.uk/full-disclosure-charter.html Hosted and
sponsored by Secunia - http://secunia.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFCcVVdpcZuLdmlFMsRAtDtAJwNK6aHB+Z6yLW7KguIsqww4ruHEQCfXydW
vL9A8T8caRcNgdpihE7Kg8k=
=Vmjj
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Steve Friedl]

Post by Georgi Guninski
i would like m$ to officially confirm they are collecting crashes and
confidential information from third parties warez.

Ok, here ya go:

http://www.microsoft.com/whdc/maintain/StartWER.mspx

Lots of third-party application developers are grateful for this free
service, especially since building the infrastructure to support it
couldn't be cheap.

Steve