Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 5 Aug 2009 14:13:04 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Matthias Andree <matthias.andree@....de>
cc: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: fetchmail <= 6.3.10 SSL certificate
 NUL prefix verification bypass


On Wed, 5 Aug 2009, Matthias Andree wrote:

> - for this problem class (NUL in CN/subjectAltName allows impersonation of
> other sites), add a sort of "umbrella CVE" that will reference the
> individual application CVEs. Would this work?

I am generally wary of assigning umbrella CVEs for implementation bugs
that lots of applications happen to contain at the same time.  That's like
giving a single CVE for "FTP server buffer overflow via long USER name" -
which has happened to at least 20 separate implementations in the past.

Generally, the only time that I find umbrella CVEs "tolerable" are during
disclosures that involve massive sets of test cases and lots of
implementations; the PROTOS SNMP disclosures from 2002(?) are the
canonical example.

An umbrella CVE for a fundamental design problem is a different story
because one "developer" made a mistake - the original designer.

So use CVE-2009-2666 for fetchmail (I'll fill it in later) and Tomas, even
if it results in dozens of CVEs, I suspect this is how we should go.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.