Date: Tue, 20 Mar 2012 10:30:08 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Nick Kralevich <nnk@...gle.com> Subject: Re: CVE request -- kernel: execshield: predictable ascii armour base address On 03/20/2012 10:01 AM, Nick Kralevich wrote: > Can someone explain to me why this is worthy of a CVE? I can see this as a > bug of course. But a "vulnerability"? > > This bug, by itself, does not cause a vulnerability. It just makes > vulnerabilities easier to exploit. I'm not sure this is worthy of a CVE > unless we're willing to assign CVEs to all fixed address allocations. > > -- Nick To quote Steven on a previous issue: http://seclists.org/oss-sec/2012/q1/177 =================== In this case, the product's security feature is not living up to its advertised capability (by generating shorter passwords than expected) so, even if it's not that severe an issue, it's probably still of some importance to some people. =================== in this case replace "shorter passwords" with "random addresses that are not random". -- Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.