Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 11 Apr 2011 14:36:51 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: pure-ftpd STARTTLS command injection / new CVE?

CVE's rationale here is that Wietse Venema discovered a class of 
implementation bugs against the same prototol - it's not a vulnerability 
in the protocol itself.  CVE-wise, this situation is not fundamentally 
different from 20+ FTP server implementations that have had buffer 
overflows in the username, or lots of web server directory traversals 
through GET requests (not joking here).  The original publication and CVE 
usage seemed to imply that the CVE would be the same for all 
implementations, but we don't do that except in really really high-volume, 
low-detail situations (e.g. PROTOS SNMP 2002).

- Steve

On Mon, 11 Apr 2011, Mike O'Connor wrote:

> :
> :
> :states that pure-ftpd is affected by the same STARTTLS
> :injection bug as postifx's CVE-2011-0411.
> :
> :Is this CVE postfix-specific or can it be used for
> :pure-ftpd as well? If needed, can someone assign a new CVE?
> It should get its own CVE assignment.  Other products with the
> same STARTTLS issue have gotten unique CVE assignments for them
> -- see CVE-2011-143[012].
> -- 
> Michael J. O'Connor                                
> =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
> "You can't destroy everything.  Where would you sit?"               -The Tick

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.