Date: Tue, 18 Jun 2013 00:04:30 -0600 From: Kurt Seifried <kseifried@...hat.com> To: Open Source Security <oss-security@...ts.openwall.com> Subject: Thoughts on a vuln/CVE? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So I know technically CVEs are for software and not for services. But in this case: =================== http://bits.debian.org/2013/06/remove-debian-multimedia.html The unofficial third party repository Debian Multimedia stopped using the domain debian-multimedia.org some months ago. The domain expired and it is now registered again by someone unknown to Debian. (If we're wrong on this point, please sent us an email so we can take over the domain! ;) ) This means that the repository is no longer safe to use, and you should remove the related entries from your sources.list file. After all, the need of an external repository for multimedia related packages has been greatly reduced with the release of Wheezy, which features many new and updated codecs and multimedia players. Not sure if you're using the debian-multimedia repository? You can easily check it by running: grep -i debian-multimedia.org /etc/apt/sources.list /etc/apt/sources.list.d/* If you can see debian-multimedia.org line in output, you should remove all the lines including it. =================== We have software with a now insecure configuration as it points to a site that may or may not be under attacker control. It seems to me like this might be a candidate for a CVE. Thoughts and comments for and against are welcome (I'm on the fence myself). - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRv/htAAoJEBYNRVNeJnmTq7gP/3jjmPLrs4CHC48Vv4dF4E64 FO8zIcqmr+0pxHNmTc34Yd+5/sCYE25EYe7diAvL0LSv5ZSz4aM8yv+sCaARJFah bYdOr5HIMHNR5x0pl+ysqQL1RVpzArqrYL1NGCeYCxrtxwkvZ85ZxH47Kg3hdvT5 JL0HJyCi8cWGSbnBQce2WUm9rSFtJIIH1hTesewZEi3bJmEJ0fHeti7ZBxMDFLIs EKduQFNZnEZh7juGULf6lp32t9s62A1XgKdubQqoiMk1UKFW2ScEEjgc8frAlo1y POeEvGAEjF9pohfK5jnPjhUW/HcezJPv9ZarA0nGdPPjRVnLqPygN6qPRktklY+f pVb2Zb41CaK0JBvm8fbLv1xifA2d4YitekVTwbsnkv1Jc8actyyC5u2U5GBoeiwr fAlTGCRq0NMQslNygjaifsULBLva3hHYgfm7PejCUpDT/uxfliSurgA6zEMqLOQd GAolEwypDzQCo2Nf4QId8JG22TRFXIH1C00RTSBYsgUECZzhUBs9VMJLKSpGLdxb wZFhpmNBirnbeWbSLRCI+bs9st87ERwmmn12+lESJ3CWRhzwpQJBvKPfWAC+sHqF DyTSsjqcLKV9R1B8pZ8YKKqZ4R1Svo9MYQnkNxTPvm+/DBDUIGeHRd2v4CukrLHX 69/x4Oom1eyYXI42YPE5 =blKB -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.