|Main Archive Page > Month Archives > full-disclosure-uk archives|
Steven Adair wrote:
> However, regardless of whether it results in remote code execution, I
> don't think a DoS should necessarily be discounted as frivolous or
> irrelevant. It might not rank up there with critical or high
> vulnerabilities, but it is a vulnerability nonetheless.
The severity of a DOS is entirely context dependent. That's why software users need to informed about the DOS so they can decide how critical it is in their context. A home user who rarely uses an ActiveX .ocx may consider a DOS of that feature negligible. If that ocx (probably not a PowerPoint viewer) is used in controlling a catalytic cracker, then a DOS is a lot more serious.