MS Excel exploit on auction

geo_2677 writes "Someone had put up for auction on eBay the details of an exploit in Microsoft Excel according to a recent article on Securityfocus. According to the article Microsoft has confirmed that this vulnerability exists, but in the meantime the original listing on eBay has been pulled. " The now pulled auction, but it does appear that Microsoft has confirmed the vulnerability in an eweek article.

Comments

More information and a few questions:

[TripMaster Monkey]

First, in the interest of stimulating more informed discusion, here is some more information concerning the auction:

• The actual article on SecurityFocus (not the abbreviated discussion article referenced in TFS).
  
• The full text of the auction, courtesy of the good folks at the OSVDB blog.
  
• The screenie of the actual eBay auction, again courtesy of OSVDB.

From the auction text:

The lot: One 0-day Microsoft Excel Vulnerability

Up for sale is one (1) brand new vulnerability in the Microsoft Excel application. The vulnerability was discovered on December 6th 2005, all the details were submitted to Microsoft, and the reply was received indicating that they may start working on it. It can be assumed that no patch addressing this vulnerability will be available within the next few months. So, since I was unable to find any use for this by-product of Microsoft developers, it is now available for you at the low starting price of $0.01 (a fair value estimation for any Microsoft product).

A percentage of this sale will be contributed to various open-source projects.

Second, two questions:

1. As the seller did in fact report this vulerability to Microsoft first, would his subsequent attempt to call attention to the vulnerability by posting it for auction on eBay be considered 'irresponsible'?
   
2. Exactly which eBay rule did this auction break?

Discuss.

Re:More information and a few questions:

[sh00z]

2. Exactly which eBay rule did this auction break?

Probably the restriction on downloadable media, because the seller stated intent to e-mail the file, but did not explicitly state that he is the copyright owner of the electronic file(s) for sale. It seems that M$ would have had a court injunciton to prove criminal intent.

Re:Supression of information is a necessary

[Ph33r th3 g(O)at]

In the first case, yes. In fact, that right has already been upheld and Esquire (IIRC) published an article that describes how to make a nuclear weapon. In the second case, you're talking about classified material that only those with clearances who agreed not to disclose it would be privy to, and that's not a valid comparison. I find it ironic that someone with the name "think freely" would argue in favor of suppression of information.