Re: Hidden Microsoft CVEs And No Answers

[jericho <jericho@attrition.org>]

On Sat, 25 Mar 2017, Carsten Eiram wrote:

: It has now been 6 business days, and I have still not received an 
: answer. Historically, Microsoft have otherwise been good at 
responding 
: quickly to such requests.

The last 45 days of dealing with Microsoft has been extremely 
disappointing for me as well. When contacting them twice about random 
CVEs 
they assigned in 2016 and then seemingly removed from advisories, and 
then 
when questioning the affected products in Jan 17 patch releases, 
answers 
are not forthcoming. It is taking them days to ack the mail, then weeks 
to 
follow-up. In some cases it was a 4+ week process to resolve the 
questions. Right now, I still have two requests outstanding, one CVE 
related.

: I'd appreciate if Microsoft could shed some light on this.

As Carsten notes, this is a turnaround from how responsive Microsoft 
used 
to be even mid to late last year. Something has changed inside MSRC 
clearly.

.b