11–20 of 182 posts
Also, if AMD is getting overwhelmed with security reports (a la curl), it's also not surprising. Particularly if people are using AI to turn bug bounties into income.
Lastly if it requires a compromised DNS server, someone would probably point out a much easier way to compromise the network rather than rely upon AMD driver installer.
They're not considering it not to be a vulnerability. They're simply saying it's outside the scope of their bug bounty program.
They're not considering it not to be a vulnerability. They're simply saying it's outside the scope of their bug bounty program.
They're not considering it not to be a vulnerability. They're simply saying it's outside the scope of their bug bounty program.
Looks like there's a serious security bug in their scope document.
Whether you agree with whether this rule should be out-of-scope or not is a separate issue.
What I'm more curious about is the presence of both a Development and Production URL for their XML files, and their use of a Development URL in production. While like the author said, even though the URL is using TLS/SSL so it's "safe", I would be curious to know if the executable URLs are the same in both XML files, and if not, I would perform binary diffing between those two executables.
I imagine there might be some interesting differential there that might lead to a bug bounty. For example, maybe some developer debug tooling that is only present only in the development version but is not safe to use for production and could lead to exploitation, and since they seemed to use the Development URL in production for some reason...
Earlier quoted context omitted.
Looks like there's a serious security bug in their scope document.
How's that? What do you think the purpose of a bug bounty is? If you think it's "to eradicate all bugs", no, very no.
Earlier quoted context omitted.
Looks like there's a serious security bug in their scope document.
How's that? What do you think the purpose of a bug bounty is? If you think it's "to eradicate all bugs", no, very no.
Earlier quoted context omitted.
How's that? What do you think the purpose of a bug bounty is? If you think it's "to eradicate all bugs", no, very no.
I don't expect an unbounded scope but I do expect it to cover the big scary headline items like RCE. Additionally, this can be exploited without MitM if you combine with e.g. a DNS cache poisoning attack. And they can still fix it even if they're not willing to pay a bounty.
http://www2.ati.com/...
But now ati.com is going straight into my unbound DNS server's blocklist.
Earlier quoted context omitted.
How's that? What do you think the purpose of a bug bounty is? If you think it's "to eradicate all bugs", no, very no.
This is the place they direct researchers to report bugs. If they don’t want to pay out for MITM, that’s fine, but they should still be taking out-of-scope reports seriously
I'm skeptical to say the least. Industry standard has been to ignore MitM or certificates/signatures, not everything.