What is the process for submitting a Zero Day vulnerability?

Posted by JungleCats on Tuesday January 22, 2013 @05:44AM
from the self-post dept.

Hey there guys,

I've found a Zero Day vulnerability (Just URI XSS) though it is affecting anywhere in the range of ~6M websites (according to Google).

I was wondering what the process I should follow is. (Report to vendor, wait for them to update software then disclose?)

I also was wondering the legality of this, am I likely to get into any kind of trouble here?

~JungleCats

( 4 comments | 4 points | on HN )

Re:What is the process for submitting a Zero Day vulnerability? by netcorps on Tuesday January 22, 2013 @06:04AM (#5096536)

You could read up on http://en.wikipedia.org/wiki/Responsible_disclosure

Preferrably contact the vendor directly without publishing your findings online. Give them time to fix the issue. If they do not react and you feel there is a great danger if you do not disclose the existence of this vulnerability, publish it.

[ Parent | on HN ]

Re:What is the process for submitting a Zero Day vulnerability? by JungleCats on Tuesday January 22, 2013 @06:07AM (#5096542)

Hey there netcorps,

Thanks for the reply. I think that's the way I'll go about it.

Much appreciated!

[ Parent | on HN ]

Re:What is the process for submitting a Zero Day vulnerability? by merinid on Tuesday January 22, 2013 @08:14AM (#5096914)

Watch out. Each vendor / website has processes you may want to follow. You could also get in touch with http://www.us-cert.gov/. They are helpful in providing advice and guidance.

[ Parent | on HN ]

Re:What is the process for submitting a Zero Day vulnerability? by JungleCats on Tuesday January 22, 2013 @10:05AM (#5097403)

I appreciate the reply, I'll be sure to bookmark the link.

[ Parent | on HN ]