Ghostscript zero-day allows full server compromises

>> While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability. >> >> The person who did is Wunderfund CTO and founder Emil Lerner, who found the bug last year and used it to obtain bug bounties from companies like Airbnb, Dropbox, and Yandex. > > Folks are not obligated to donate their time.

When it comes to open-source, I think this is a weak argument. While I consider your statement true, it's a "glass half-empty" way of looking at working together to build useful software. Releasing an exploit before a fix is applied also negates work other people have put into the project.

It's surprising to me that neither Lerner, nor any of the downstream companies, upstreamed the fix in a year's time. If true that none tried, as you point out.

> Details about the vulnerability leaked into the public domain last month after Lerner held a talk at the ZeroNight X security conference about the current attack vector posed by server-side image conversion tools and used the Ghostscript zero-day as an example.

While I can understand trying to get larger payouts and I still think what the researcher did is unethical, I'm even more disappointed with the security process of those downstream companies, they have to be pretty incompetent to not immediately burn the vulnerability by reporting it upstream. Unless of course they were planning on exploiting their competitors using it, which is even worse. Probably more likely is employees are forbidden from contributing back to open source, which means they each have incompetent legal departments.