Quick clarification on several points based on emails that I've received:
1) We did notify Apache before going public. ISS X-Force emailed
Apache in the morning at 9:44am regarding this Advisory. We waited until
the afternoon before sending to Bugtraq for approval and finally reaching
the
There has been a lot of misinformation spread about our ISS Apache Advisory
and wanted to clean up any confusion and misunderstanding.
1) Our policy for publishing advisories is to give a vendor 30 to 45
day quiet period to provide an opportunity to create a patch or work around.
If an expl
