[ISN] 10 Infamous Moments In Security Research

[InfoSec News]

http://www.informationweek.com/security/showArticle.jhtml?articleID=185301327

InformationWeek 
Apr 17, 2006

1. SQL Slammer - Researcher David Litchfield presents findings at
   Black Hat one week after Microsoft issues its SQL patch. Slammer
   worm that exploits that flaw dramatically slows Internet traffic in
   2003.

2. Windows Plug and Play - Internet Security Systems researchers in
   April 2005 discover Windows vulnerability that lets attacker take
   control of affected systems and remotely execute code. By August,
   Zotob worm exploits it.

3. Cisco IOS heap overflow - Former ISS researcher Michael Lynn in
   July 2005 shows hackers could take control of a company's network.
   Cisco had issued a patch in April, but it still sues Lynn over the
   speech.  The suit is later dropped.

4. Windows Metafile - Researcher H.D. Moore and others post exploit
   code of this flaw in January, and researcher Ilfak Guilfanov writes
   unauthorized workaround. This prompts Microsoft to issue a patch
   five days ahead of schedule.

5. Oracle transparent data encryption - Red-Database-Security
   researcher Alexander Kornbrust reports vulnerability in January
   2006; Oracle patches it the same month.

6. Oracle PLSQL gateway - Litchfield in January shows Black Hat
   attendees a vulnerability in Oracle's Procedural Language extension
   to SQL. Oracle has yet to patch.

7. Apple Mac iChat - An unknown person posts on MacRumors.com an
   external link to the OSX/Leap.a Trojan on Feb. 13, 2006, the first
   virus for the Apple Mac OSX platform.

8. Internet Explorer createTextRange() - Researcher Andreas Sandblad
   discovers flaw in March that lets hackers install malwarelike
   keystroke loggers. eEye Digital Security issues a patch.

9. Internet Explorer HTA files - Dutch researcher Jeffrey van der Stad
   in March alerts Microsoft to problem with how IE processes HTML
   apps. Van der Stad pares back information about the bug on his Web
   site when Microsoft complains.

10. Sendmail SMTP server software - ISS in March finds vulnerability
    in this popular Internet E-mail transfer agent. Sendmail issues
    patch immediately.