Date: Wed, 5 Aug 2009 14:13:04 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: Matthias Andree <matthias.andree@....de> cc: oss-security@...ts.openwall.com, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass On Wed, 5 Aug 2009, Matthias Andree wrote: > - for this problem class (NUL in CN/subjectAltName allows impersonation of > other sites), add a sort of "umbrella CVE" that will reference the > individual application CVEs. Would this work? I am generally wary of assigning umbrella CVEs for implementation bugs that lots of applications happen to contain at the same time. That's like giving a single CVE for "FTP server buffer overflow via long USER name" - which has happened to at least 20 separate implementations in the past. Generally, the only time that I find umbrella CVEs "tolerable" are during disclosures that involve massive sets of test cases and lots of implementations; the PROTOS SNMP disclosures from 2002(?) are the canonical example. An umbrella CVE for a fundamental design problem is a different story because one "developer" made a mistake - the original designer. So use CVE-2009-2666 for fetchmail (I'll fill it in later) and Tomas, even if it results in dozens of CVEs, I suspect this is how we should go. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.