How should I escalate a vulnerability that is dismissed by the vendor?

Question

I've come across a vulnerability that secure@microsoft does not think is worth pursuing.

I would estimate that there are many, many customers affected by this issue.

I do not want to start a grassroots campaign to fix this, as that would publish the vulnerability in the process.

What should I do?

score 8 · Accepted Answer · edited Mar 17 '17 at 13:14

8

You could:

try to persuade why this vulnerability is so severe and what consequences customers may have;
try to sell to companies like ZDI;
go full disclosure - provide detailed description and solution, e.g. patch;

I suppose there are no other ways how you could put your vulnerability fixed. Also, in your recent topic Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently? you were already pointed to How to disclose a security vulnerability in an ethical fashion?.

edited Mar 17 '17 at 13:14

Community

1

answered Nov 20 '10 at 20:51

I wasn't aware of ZDI; thank you for prompting me to research it. – makerofthings7 Nov 22 '10 at 17:12
Do note that there are many companies that will buy vulnerabilities from you but which do _not_ do so ethically. Many companies will sell the exploits to governments with a history of human rights abuses. – forest Feb 19 '19 at 03:35

score 5 · Answer 2 · answered Nov 13 '12 at 19:19

5

One option that's not been mentioned in the earlier answers is engaging with CERT to have the issue raised with the vendor. They have a reporting form on their site and will handle co-ordination with the vendor.

answered Nov 13 '12 at 19:19

Rory McCune

60,923
14
136
217

score 2 · Answer 3 · edited Jan 19 '11 at 21:11

2

I would personally consider selling it, like Ams said before. Why? They have more reach inside Microsoft (and other such companies) then you and second you get paid for your findings.

And don't worry about publishing the vulnerability, last time I checked web sites like ZDI only release the information after it's been fixed and/or patched.

edited Jan 19 '11 at 21:11

Rory Alsop

61,367
12
115
320

answered Nov 20 '10 at 23:24

Georges Duplessy

184
4

score 2 · Answer 4 · answered Nov 21 '10 at 12:14

In addition to @Ams answer (discussion/persuasion and full disclosure, I have no experience with selling them), you could possibly try contacting the product team directly - IF you happen to know who to talk to, or have a contact on the inside...
I too have found that often the MSRC are bit more resistant to accepting vulns than the product team, and once I had them work with MSRC to get them to take it (though at the time I was working with the product team already, so ....)

How should I escalate a vulnerability that is dismissed by the vendor?

4 Answers4

Linked