On: Critical SSH Backdoor in multiple Barracuda Networks Products

Here is the timeline if you're interested - 14 days from contact to publication:

2013-01-10: Sending advisory and proof of concept exploit via encrypted channel.

2013-01-14: Vendor confirms receipt and provides BNSEC IDs.

2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule.

2013-01-21: Conference call - discussing implemented solutions.

2013-01-23: Barracuda Networks releases alert & secdef

2013-01-24: SEC Consult releases coordinated security advisory.

From the post to f-d:

> 2012-11-29: Contacting vendor. > 2012-11-29: Sending advisory and proof of concept exploit via encrypted channel.

Oops. You are completely correct. I posted the timeline for the follow-up advisory! And it's too late to edit.

Oops! This is the correct timeline (the other one is a followup advisory):

2012-11-29: Contacting vendor.

2012-11-29: Sending advisory and proof of concept exploit via encrypted channel.

2012-12-04: Vendor confirms receipt and provides BNSEC IDs.

2012-12-05: Requesting further coordination (conference call).

2012-12-13: Sending reminder regarding SEC Consult disclosure policy.

2012-12-15: Vendor responds - arranging conference call.

2012-12-18: Conference call: Addressing the risks the discovered vulnerabilities pose to customers and release schedule.

2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule.

2013-01-21: Conference call - discussing implemented solutions.

2013-01-21: Vendor provides information about some questions which came up.

2013-01-22: Asking for definitive listing of affected appliances.

2013-01-23: Barracuda Networks releases alert & secdef

2013-01-24: SEC Consult releases coordinated security advisory.