Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 12 Jul 2011 10:39:46 -0400
From: "Mike O'Connor" <>
Subject: Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE?

:Hello List,
:Is it possible to assign a CVE for documented behavior? Communication

Especially in the early days of CVE, some were assigned for documented
behavior.  The one I used to hit the most is CVE-1999-0651, a CVE for
rlogind running (with all sorts of potential for insecurity based on
how it's deployed, but not necessarily insecure in and of itself).  It
would give some folks slaved to CVE-based security-scanning tools fits. 
The scan tool flags a CVE for which nothing can really be done because
it acts as documented.

 Michael J. O'Connor                                
"Security freaks are pretty wierd."                    -Brian Harvey, RFC 686

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.