Sybase to Security Researchers: Stay Quiet or Well Sue

 
 
By Lisa Vaas  |  Posted 2005-03-22 Email Print this article Print
 
 
 
 
 
 
 

Sybase has threatened legal action against security research firm NGS Software if it releases details of vulnerabilities it found last year in Sybase's Adaptive Server Enterprise product—even though Sybase already has issued patches for the flaws.

Sybase has threatened legal action against a security research firm if it releases details of vulnerabilities it found last year in Sybases Adaptive Server Enterprise product, even though Sybase already has issued patches for the flaws. Such threats of legal action are not unprecedented, but they typically come in the form of phone calls from vendors, not letters from lawyers, researchers say. NGS Software Ltd. found eight buffer-overrun and denial-of-service vulnerabilities in Sybase ASE 12.5.3 in 2004 and subsequently notified the company of the problems. Sybase Inc., based in Dublin, Calif., released an updated version of the software earlier this year and alerted customers that they should upgrade to the latest version.
NGSS, based in Surrey, England, follows a self-imposed policy of not releasing specific details of any vulnerabilities it finds until after a vendor has either fixed the problem or has had ample time to do so and has decided not to release a patch, usually three months.
The company had planned to release the details of the Sybase flaws on Monday, but that idea was scuttled when NGSS received a letter from Sybases legal department informing NGSS that it would be subject to legal action if the company went ahead with its plans to publish the details. David Litchfield, a research scientist and one of the founders of NGSS, told eWEEK.com that the crux of the matter involves the license agreement for the Developer Edition of Sybase ASE, which reads, in part: "Results of benchmark or other performance tests run on the program may not be disclosed to any third party without Sybases prior written consent."
According to Litchfield, Sybases letter states that, due to the license agreement clause, the company will consider it a "material breach" if NGSS publishes details on the security flaws. Sybase is thus equating NGSS work of finding security bugs as being the same as benchmarking and performance testing—a unique interpretation, at least in the history of NGSS. "Its shocking," said NGSS researcher Mark Litchfield—David Litchfields brother—in an interview with eWEEK.com. "If you take at least the past eight years, weve never had a response like this. The typical response [from vendors] is favorable. "Theyll let us know when a patch has come in, well test it, theyll put an advisory out, well put an advisory out, theyll say, Come here to download the patch, and at that point well release an advisory saying theres a vulnerability and this is where you can get the patch." NGSS working relationship with Sybase has been "excellent" up to now, Mark Litchfield said. "This is unprecedented for a vendor and for us, and weve dealt with IBM, Microsoft [Corp.], Oracle [Corp.], all the big ones," he said. "This is completely new for us." Next Page: NGSS says Sybase is being pressured by its Wall Street customer base.



 
 
 
 
Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel