[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 5 Nov 2012 20:56:15 +0000
From: "Christey, Steven M." <coley@...re.org>
To: Kurt Seifried <kseifried@...hat.com>, "oss-security@...ts.openwall.com"
<oss-security@...ts.openwall.com>
CC: Reed Loden <reed@...dloden.com>, "security@...library.com"
<security@...library.com>
Subject: RE: YUI 2.x security issue regarding embedded SWF
files -- or, How Not To Handle A Security Disclosure
Sorry for the delay.
If a customer "owns" the systems or networks on which the software is installed, and/or is the entity who MUST take action to fix the issue, then it qualifies for a CVE.
If the fix for the issue is entirely in the hands of the vendor without any involvement by the consumer at all, then it does not get a CVE. So, XSS on a custom web site, or a financial web site that exposes credentials, or a "typical" cloud-based offering, would generally not get a CVE. (Note that this is a gap in the industry, as vulnerability databases in general don't cover "site-specific" or service-oriented issues.)
Based on the security-announcement-swf-vulnerability-in-yui-2 post, this requires users of YUI 2 to take certain actions for "Any project that hosts YUI 2 SWF files ... on its own servers." So, this qualifies for a CVE.
- Steve
-----Original Message-----
From: Kurt Seifried [mailto:kseifried@...hat.com]
Sent: Monday, November 05, 2012 3:49 PM
To: oss-security@...ts.openwall.com
Cc: Reed Loden; Christey, Steven M.; security@...library.com
Subject: Re: [oss-security] YUI 2.x security issue regarding embedded SWF files -- or, How Not To Handle A Security Disclosure
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/04/2012 05:13 PM, Kurt Seifried wrote:
> On 11/04/2012 01:34 PM, Reed Loden wrote:
>> I haven't seen this posted at all, but it seems there's some
>> (major?) security issue regarding the SWF files embedded in YUI
>> 2. The YUI team has published a blog post regarding this problem
>> asking users to e-mail them for details.
>
>> http://www.yuiblog.com/blog/2012/10/30/security-announcement-swf-vulnerability-in-yui-2/
>
>> The comments are a great read. Ryan Grove (former Yahoo! and
>> YUI core team guy) hits the point on the head regarding
>> disclosure handling of the issue. Apparently, some
>> people/companies have already been notified directly weeks ago,
>> and this is how the YUI team is continuing the disclosure process
>> by just asking projects to e-mail them instead of just releasing
>> the fix to the public at this stage. :/
>
>> Might want to go ahead and get a CVE assigned to whatever this
>> issue is, and hope more details come out of this soon so YUI 2
>> users can actually get patched instead of having to request
>> access to the fix...
>
>> ~reed (speaking only for himself)
>
> Have any CVE's been issued for this issue? I can't find any. More
> to the point does this kind of issue (is it a service strictly?)
> even get a CVE? Steve?
Ok please use CVE-2012-5475 for this issue.
Also can security@...library.com follow their disclosure policy listed
at and disclose the problem:
http://yuilibrary.com/security/
Disclosure of Security Issues
If you've discovered a security flaw in one of our products, please
contact us. Expect to receive an acknowledgement quickly with the best
way to track your report's status. You'll have a direct contact at YUI
while we investigate.
Since issues have varying impact, we ask for your patience while we
make sure everyone who uses our products is protected. We will
disclose a problem once it's confirmed and a resolution is available.
If a fix is required, our release will credit you for your discovery.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQmCZIAAoJEBYNRVNeJnmTuYwP/0bmNMJXTRS52lGf7uPm+ErP
WeBNYBo6w4OfuUrJPrv9OYteEB73Cdm6mUj9y9MS/1rMOnYjdl7MexptgLGg3xXF
Vxp5WShi3QGtzUxVwXP8dd2a587ay2z/tMDZv5SGMKi0CNMQ3VxyatPmt+0vLJfK
loIBlrqmLU3ETWUjTejPgDLJ7RIjq2vRFN5zPMfHIRDQDuxe10554hmH0bRvMpIP
mLqnGXdl+I1mNzcOVCACyTLiU9Lc2ZObzNF2mMRbuDsSXi3DurLq2J/iXpgwZNU6
xFhZPqNd2LuyMTFtZbRoYC+mk6DlZTmajU83u+1dY8lHeoKyoSqFq1nObO9N9Zjh
NUiX3nUvedUYIP/cA+7wkWgihS5f+7UTYPMmXqJPRoO6kWrJD/+o050AgLxJXsWX
g5wb+Lp/oVolfYBVPwbxbJOtG163T/abRCyYca7J3EbL3Iq1Su0E5PB0qOMsPrkh
PkJuH5h1tOx6rMscq7clq5xa4aDRrHl46F/MICWD336V7CaGz82EsXXYLmc9uzcf
9keOUc7kAGlA6jP4CU+M3K1dKQzPOrXsYXdeTKSqJnkdm/1s/KdDH/uLLVzqyjPC
vdz1EWDr7+xyxF3Iv7foZyFj4fKcp2pTVOYhAnw0bwyHA+f2aj4SPaNS33d8JhIi
18alDP7bu/OWSfWX+54Q
=KDpL
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
