Date: Sat, 2 Feb 2013 14:59:03 +0100 From: Peter Bex <Peter.Bex@...all.nl> To: Open Source Security <oss-security@...ts.openwall.com> Subject: A small backlog of vulnerabilities in Chicken Scheme Hello all, Recently a handful of security bugs have been found and fixed in the Chicken Scheme compiler (http://www.call-cc.org). We (the core team) have decided we'd like to start using CVE identifiers for the benefit of our users and distributions. I'd like to request CVEs for the currently known security bugs: * POSIX select() buffer overrun, fixed on in Chicken 4.8.2 (development snapshot) by switching to POSIX poll() on platforms where supported. This is also fixed in 220.127.116.11 (stability release). Original announcement, with workaround (followed by preliminary patch): http://lists.nongnu.org/archive/html/chicken-users/2012-06/msg00031.html Final patch: http://lists.nongnu.org/archive/html/chicken-hackers/2012-11/msg00075.html * Poisoned NUL byte injection due to incomplete protection by missing checks in some procedures, fixed in Chicken 4.8.0: http://lists.nongnu.org/archive/html/chicken-users/2012-09/msg00004.html * Broken randomization procedure on 64-bit platforms (it returned a constant value). This function wasn't used for security purposes (and is advertised as being unsuitable), so I'm unsure a CVE is needed: http://lists.nongnu.org/archive/html/chicken-hackers/2012-02/msg00084.html Fixed in 4.8.0. * Vulnerability to algorithmic complexity attacks due to hash table collisions. Fixed in 4.8.0. First public confirmation of the issue, with preliminary (broken) patch: http://lists.nongnu.org/archive/html/chicken-hackers/2012-01/msg00002.html Proper fix: http://lists.nongnu.org/archive/html/chicken-hackers/2012-01/msg00020.html Please let me know if more info is required or if this is even the proper way to request CVEs. I'd also like to know if it's possible to get CVE numbers assigned *before* issuing a security advisory, but without immediate full disclosure, so an initial advisory can be complete with CVE number. The CVE can be updated afterwards with the link to the advisory when it is issued. This should make it easier for users to find information about the bug. This list's Openwall wiki seems to imply that it's only possible to request a CVE for an issue given all the information immediately, but a recent message from Kurt Seifried in a thread about Jenkins says that it can be done. If it's indeed okay to e-mail Kurt directly, it would be helpful to include this in the documentation wiki. Finally, how do CVE entries in MITRE and/or the NVD get updated? I couldn't find anything about this in the FAQ. For example, if we find and fix a noncritical vulnerability but the fix is rather complicated and needs to be thoroughly tested, the fix might appear in a release after CVE and advisory are issued. How will this be reflected in the information once the version in which the fix appears is finally known? Cheers, Peter Bex (on behalf of the Chicken core team)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.