Qualcomm first started selling WorldMail 3.x in May 2005, as evidenced by its . The WorldMail bug was reported to Qualcomm in September 15, 2006. So, 16 months later, existing WorldMail 3.x customers are stuck with an exploitable product. It makes you wonder how long WorldMail 3.x was supported before falling off the table. A year, maybe?

If Qualcomm (or Rockcliffe) wants to make this right, one of them needs to stop pointing fingers, take ownership of the problem, and assign a programming team to fix the bug to protect customers. Or I'm hoping that maybe the vulnerability report is incorrect and one of the two vendors is planning a fix -- although I couldn't find any information on either Web site, so I doubt there's a fix in progress.

I'm a firm believer in free markets and voting with consumer dollars. The next time Qualcomm pitches your company a software product, don't expect them to support it for even two years.