Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CANTw=MMXv-udc7wSAsWr0oiDdv3vbQ=UYDpfL=WGAHBA6DNTLw@mail.gmail.com>
Date: Fri, 3 May 2013 23:07:07 -0400
From: Michael Gilbert <mgilbert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re-emergence of CVE-2008-4796 in Nagios current

On Tue, Apr 30, 2013 at 7:28 PM, David Jorm wrote:
>> CVE-2008-4796 snoopy: command execution via shell metacharacters
>>
>> Was found in Nagios core by Grant Murphy.
>>
>> Filed upstream: http://tracker.nagios.org/view.php?id=449
>>
>> We really need to start thinking about ways to find vulnerable copies
>> of code and fixing them everywhere people have embedded them.
>
> Debian uses clonewise:
>
> https://github.com/silviocesare/Clonewise

There is also a human-researched list, which is never really up to
date or anywhere near comprehensive:
http://anonscm.debian.org/viewvc/secure-testing/data/embedded-code-copies?view=co

Best wishes,
Mike

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.