ZERT MANIFESTO
ZERT is a group of engineers with extensive experience in reverse engineering software, firmware and hardware coupled with liaisons from industry, community and incident response groups. While ZERT works with several Internet security operations and has liaisons to anti-virus and network operations communities, ZERT is not affiliated with a particular vendor.
ZERT members work together as a team to release a non-vendor patch when a so-called "0day" (zero-day) exploit appears in the open which poses a serious risk to the public, to the infrastructure of the Internet or both. The purpose of ZERT is not to "crack" products, but rather to "uncrack" them by averting security vulnerabilities in them before they can be widely exploited.
It is always a good idea to wait for a vendor-supplied patch and apply it as soon as possible, but there will be times when an ad-hoc group such as ours can release a working patch before a vendor can release their solution.
------------------------
The ZERT's first Zero-day patch has been released.
ZERT2006-01: Buffer overflow in Vector Markup Language (VML) library file used by Microsoft Internet Explorer and Outlook
-------------------------
The ZERT isn't a loose group of no-names.
The member list includes Ilfak Guilfanov, Matthew Murphy, Micheal Lynn, John Cartwright, Halvar Flake, Gadi Evron, Paul Vixie, Nick FitzGerald and others.
No comments:
Post a Comment