oss-security - Re: Fwd: IPv6 DOS vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Oct 2012 22:39:22 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Fwd: IPv6 DOS vulnerabilities

Hi,

Thanks for posting this, Marc.

On Wed, Oct 10, 2012 at 06:55:07PM +0200, Marc Heuse wrote:
> (I am sitting on this for over a half year now, sorry for that)

Just to clarify: this "half a year" delay occurred before Marc notified
the distros list, which he did on September 20.  (I was not aware of
Marc's work on this before that date either.)  Thus, as far as the
distros list is concerned, the issues were reported to distro vendors and
embargoed for 20 days, which is a slight violation of the list's policy
(14 to 19 days max, depending on day of week).  I apologize for this.
I did not insist on Marc disclosing the issues publicly sooner than he
wanted to for reasons similar to what we had with hashDoS last year
(just a DoS, which the researchers wanted to disclose at a certain con),
although I did remind him and recommend posting to oss-security sooner,
so that I wouldn't have to apologize. ;-)

It appears that vendors did not care to patch mere IPv6 DoSes promptly
enough anyway, so the embargo did not help.

Notifying the distros list closer to the intended public disclosure date
would be more appropriate - it would reduce the window of partial
exposure.  Not providing any advance notification would be even better
in this specific case (since apparently no action was taken anyway), but
this was impossible to know reliably in advance.

Thanks again,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.