IBM however did say that it had fumbled the report. "A process error resulted in an improper response to the researcher who reported this situation to IBM," a company spokesperson told The Register. "We have been working on mitigation steps and they will be discussed in a security advisory to be issued."
Ribeiro dismissed IBM's response in an email to The Register. "Well, what can I say," he said. "It's a joke right? I think it's pretty sad that I have to disclose a zero-day and shame them publicly to get them to patch critical vulnerabilities in a security product, while they sell themselves as an elite company providing security services." "Like I said in my advisory, I was just looking to disclose it to them without asking anything in return except a mention when the vulnerability was fixed.
![[correlate]](/data/avatars/m/79/79653.jpg?1556985072){kind=avatar}
thehackernews.com
![[correlate]](/data/avatars/s/79/79653.jpg?1556985072){kind=avatar}