9

I've come across a vulnerability that secure@microsoft does not think is worth pursuing.

I would estimate that there are many, many customers affected by this issue.

I do not want to start a grassroots campaign to fix this, as that would publish the vulnerability in the process.

What should I do?

7

You could:

  1. try to persuade why this vulnerability is so severe and what consequences customers may have;
  2. try to sell to companies like ZDI;
  3. go full disclosure - provide detailed description and solution, e.g. patch;

I suppose there are no other ways how you could put your vulnerability fixed. Also, in your recent topic Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently? you were already pointed to How to disclose a security vulnerability in an ethical fashion?.

  • I wasn't aware of ZDI; thank you for prompting me to research it. – goodguys_activate Nov 22 '10 at 17:12
  • Do note that there are many companies that will buy vulnerabilities from you but which do not do so ethically. Many companies will sell the exploits to governments with a history of human rights abuses. – forest Feb 19 '19 at 3:35
4

One option that's not been mentioned in the earlier answers is engaging with CERT to have the issue raised with the vendor. They have a reporting form on their site and will handle co-ordination with the vendor.

2

In addition to @Ams answer (discussion/persuasion and full disclosure, I have no experience with selling them), you could possibly try contacting the product team directly - IF you happen to know who to talk to, or have a contact on the inside...
I too have found that often the MSRC are bit more resistant to accepting vulns than the product team, and once I had them work with MSRC to get them to take it (though at the time I was working with the product team already, so ....)

1

I would personally consider selling it, like Ams said before. Why? They have more reach inside Microsoft (and other such companies) then you and second you get paid for your findings.

And don't worry about publishing the vulnerability, last time I checked web sites like ZDI only release the information after it's been fixed and/or patched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.