Date: Mon, 11 Apr 2011 14:36:51 -0400 (EDT) From: "Steven M. Christey" <coley@...-smtp.mitre.org> To: oss-security@...ts.openwall.com Subject: Re: pure-ftpd STARTTLS command injection / new CVE? CVE's rationale here is that Wietse Venema discovered a class of implementation bugs against the same prototol - it's not a vulnerability in the protocol itself. CVE-wise, this situation is not fundamentally different from 20+ FTP server implementations that have had buffer overflows in the username, or lots of web server directory traversals through GET requests (not joking here). The original publication and CVE usage seemed to imply that the CVE would be the same for all implementations, but we don't do that except in really really high-volume, low-detail situations (e.g. PROTOS SNMP 2002). - Steve On Mon, 11 Apr 2011, Mike O'Connor wrote: > :http://www.pureftpd.org/project/pure-ftpd/news > : > :states that pure-ftpd is affected by the same STARTTLS > :injection bug as postifx's CVE-2011-0411. > : > :Is this CVE postfix-specific or can it be used for > :pure-ftpd as well? If needed, can someone assign a new CVE? > > It should get its own CVE assignment. Other products with the > same STARTTLS issue have gotten unique CVE assignments for them > -- see CVE-2011-143. > > -- > Michael J. O'Connor mjo@...o.mi.org > =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--= > "You can't destroy everything. Where would you sit?" -The Tick >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.