Date: Mon, 3 Nov 2008 09:02:21 +0100 From: Tomas Hoger <thoger@...hat.com> To: coley@...us.mitre.org Cc: oss-security@...ts.openwall.com Subject: Re: CVE-2008-4619 / milw0rm6775 Hi Steven! On Fri, 31 Oct 2008 16:18:36 -0400 (EDT) "Steven M. Christey" <coley@...us.mitre.org> wrote: > > Looks like this is a dupe of CVE-2007-0165 after all... > > > > http://www.securityfocus.com/bid/21964/ > > http://secunia.com/advisories/23700/ > > http://secunia.com/advisories/32403/ > > Nothing against these sources but in general CVE wants a solid "logic > chain" between 2 descriptions before declaring a dupe. In this case > CVE-2007-0165 is anchored on a very vague description from Sun about > something in libnsl. CVE-2008-4619 is quite specific. Just because > it's the same rpcbind service is insufficient as we all know that the > same package can contain multiple security bugs. Sorry for not choosing word properly here. I probably should have used "looks like this *may* be a dupe of...". My reasoning for calling it dupe was that CVE-2007-0165 links BID-21964, which has the same exploit attached as is available on milw0rm as 6775. It's not clear when exploit code was added to the BID, though. -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.