The information in the advisory is based on what the ISC told us prior to
its release. We provided the ISC with 160k of diffs against 1.5.0, well
in advance of the release of 1.5.1. They chose not to include them in the
1.5.1 release, and incorporated them into the latest beta.
When the ISC informed us that they would have a beta which included our
fixes availible, we released the advisory at approximately the time the
fixes were supposed to be available. At the time, James Brister, who
maintains INN for the ISC, informed us that there would be no patches for
versions earlier than 1.6.
Apparently, it has since transpired that INN 1.6beta1 is not as stable as
the ISC believed. Therefore, they have decided to release a set of
patches against 1.5.1.
The reason we posted is this. The overflows present in INN were trivial to
find. In fact, had they not been actively exploited in the wild before the
advisory, we would be *shocked*. Would you rather that nobody except
those who are interested in cracking your systems know about these
problems, or would you rather be properly appraised of the dangers of
certain software?
David Sacerdote