Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 06 Feb 2013 19:29:10 -0700
From: Kurt Seifried <>
To: Open Source Security <>
Subject: Re: A small backlog of vulnerabilities in Chicken

Hash: SHA1

Sorry for the delay, it's been a crazy couple of weeks.

On 02/02/2013 06:59 AM, Peter Bex wrote:
> Hello all,
> Recently a handful of security bugs have been found and fixed in
> the Chicken Scheme compiler (  We (the core
> team) have decided we'd like to start using CVE identifiers for the
> benefit of our users and distributions.
> I'd like to request CVEs for the currently known security bugs:
> * POSIX select() buffer overrun, fixed on in Chicken 4.8.2
> (development snapshot) by switching to POSIX poll() on platforms
> where supported. This is also fixed in (stability
> release).
> Original announcement, with workaround (followed by preliminary
> patch): 
Final patch:

you list the versions released that included the broken and
correct patch? thanks.

> * Poisoned NUL byte injection due to incomplete protection by
> missing checks in some procedures, fixed in Chicken 4.8.0: 
>  * Broken randomization procedure on 64-bit platforms (it returned
> a constant value).  This function wasn't used for security
> purposes (and is advertised as being unsuitable), so I'm unsure a
> CVE is needed: 
Fixed in 4.8.0.

no problem here, will assign once other Q's are answered.

> * Vulnerability to algorithmic complexity attacks due to hash
> table collisions.  Fixed in 4.8.0. First public confirmation of the
> issue, with preliminary (broken) patch: 
Proper fix:

you list the versions released that included the broken and
correct patch? thanks.

> Please let me know if more info is required or if this is even the 
> proper way to request CVEs.
> I'd also like to know if it's possible to get CVE numbers assigned 
> *before* issuing a security advisory, but without immediate full 
> disclosure, so an initial advisory can be complete with CVE
> number.

Yup see the HOWTO. Initially I'll require full info up front to make
sure CVE split/merge is done correct, but this wouldn't go past me,
and if you can't trust me, well, then you go to Mitre I guess =).
Longer term depends on the quality of CVE requests, basically if you
learn to do them right and do them consistently right I'll require
less info/trust you.

> The CVE can be updated afterwards with the link to the advisory
> when it is issued.  This should make it easier for users to find
> information about the bug.  This list's Openwall wiki seems to
> imply that it's only possible to request a CVE for an issue given
> all the information immediately, but a recent message from Kurt
> Seifried in a thread about Jenkins says that it can be done.  If
> it's indeed okay to e-mail Kurt directly, it would be helpful to
> include this in the documentation wiki.
> Finally, how do CVE entries in MITRE and/or the NVD get updated? I
> couldn't find anything about this in the FAQ.  For example, if we 
> find and fix a noncritical vulnerability but the fix is rather 
> complicated and needs to be thoroughly tested, the fix might
> appear in a release after CVE and advisory are issued.  How will
> this be reflected in the information once the version in which the
> fix appears is finally known?
> Cheers, Peter Bex (on behalf of the Chicken core team)

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Version: GnuPG v1.4.13 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.