[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 15 Jun 2017 10:28:04 -0700
From: Kurt H Maier <khm@...ops.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: MySQL - use-after-free after
mysql_stmt_close()
On Thu, Jun 15, 2017 at 08:21:29AM -0600, Kurt Seifried wrote:
> 1) Official documentation that says "do this [insecure thing]" should
> probably get a CVE (e.g. "turn off all the encryption to make it work more
> easily"). This should probably get a CVE, especially as it results in
> operational changes which won't get a CVE (since it's not in code that
> "ships", it's just on the end of whoever is using it).
I really like this idea. What would be the approach to software whose
documentation starts out with "turn off selinux," out of curiosity?
Obviously this lessens the security stance of the system, but presumably
the system is designed to be operable without selinux. Would CVEs get
assigned for all bad ideas, or just those that expose actual attack
vectors?
> 3) Unofficial but commonly used documentation and code examples, I guess
> the best example here is stackoverflow and friends?
This is going to cause you to hit INT_MAX relatively quickly.
khm
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
