The question I have been asked is if a tester uses this exploit and gains control of a machine, what does it mean? Does it mean your security is lacking, or that your update process is slow an inadequate? To me, it just means you have room for growth.
Take an example of using the Webdav exploit in a phishing attack where I am able to compromise a workstation. If I am able to do nothing else but poke around the workstation, gather network traffic, and attempt to trick other people into falling victim to the attack, then mitigating controls are working. If I am able to access to workstation and elevate myself to domain admin, add myself to the payroll, and write myself a check, multiple controls have failed.
The detractors that don't want these new attacks used in tests are often the ones surprised when a real attacker will use them in the wild. Good testing means using everything at your disposal, putting shackles on your tester just means you are putting shackles on your organization's ability to improve. So the "no zero day" penetration-test philosophy is about as useful as a "gun-free zone" at protection.
David Maynor is CTO of Errata Security. Special to Dark Reading