Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 12 Jul 2011 10:39:46 -0400
From: "Mike O'Connor" <mjo@...o.mi.org>
To: oss-security@...ts.openwall.com
Subject: Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE?

:Hello List,
:
:Is it possible to assign a CVE for documented behavior? Communication

Especially in the early days of CVE, some were assigned for documented
behavior.  The one I used to hit the most is CVE-1999-0651, a CVE for
rlogind running (with all sorts of potential for insecurity based on
how it's deployed, but not necessarily insecure in and of itself).  It
would give some folks slaved to CVE-based security-scanning tools fits. 
The scan tool flags a CVE for which nothing can really be done because
it acts as documented.

-- 
 Michael J. O'Connor                                          mjo@...o.mi.org
 =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"Security freaks are pretty wierd."                    -Brian Harvey, RFC 686

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.