Date: Wed, 15 Oct 2008 14:28:37 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com, Jamie Strandboge <jamie@...onical.com> cc: jdong@...ntu.com Subject: Re: CVE request: jhead On Wed, 15 Oct 2008, Jamie Strandboge wrote: > CC'ing John, as he is who found the majority of the issues and > coordinated with upstream. So the jhead changelog only acknowledges "potential string overflows". John's comment in bug 271020 alludes to various other types of issues, but specifics are unknown. And there are some references to other overflows that may or may not have been fixed by upstream. So, we'd need multiple CVEs, but how many is unclear. 1 - long -cmd 2 - unsafe temp file creation 3 - "more unchecked buffers" and "unsafe buffer sized strcat's in ModifyDescriptComment" [this assumes that upstream only fixed issue 1) 4 - shell escapes Without knowing what exactly is being reported and fixed, it's pretty difficult to assign CVEs, especially with phrases like "more unchecked buffers" that could apply to anything. Use CVE-2008-4575 for the "long -cmd" ONLY - and whatever other overflows the upstream developer fixed. (That is, CVE-2008-4575 is focusing on what was fixed by upstream, not what's in the Ubuntu bug report). - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.