[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Jun 2013 00:13:34 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Russ Allbery <rra@...nford.edu>
CC: oss-security@...ts.openwall.com, cve-assign@...re.org,
"Steven M. Christey" <coley@...re.org>
Subject: Re: 1.2k bug reports for Debian, some may be security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/26/2013 11:56 PM, Russ Allbery wrote:
> Kurt Seifried <kseifried@...hat.com> writes:
>
>> I will of course be doing CVEs for these (*sob*). In order to
>> make this possible though I'm going to need some help in the form
>> of good CVE requests in this case I will be fascist.
>
> I suspect you will not want to be doing CVEs for most of these.
> The ones I've seen so far aren't really security issues. They're
> cases of command-line programs crashing on input, but usually input
> that is not feasibly under the control of an attacker (command-line
> options provided by the user, etc.).
>
> My guess is that the vast majority of these problems are
> robustness issues, but are not security issues under any reasonable
> threat model that I can think of.
>
Yup. hence the "Attack outcome (is this a security vulnerability in
other words)". I'm hoping <10% of these are security vulnerabilities.
But anything setuid/setgid, etc.... all sorts of potential for problems.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRy9gNAAoJEBYNRVNeJnmTJuQP/3MxneL9auzCGqT156Qu0A40
njwYBrJBoMXNi8hPyIMJT1USGIWGpYwW4nMi2cGYWZIZU0w+sfuBpKjqtb6VtNp8
tB53S2+5/J3Cnjo0JJWI3EULDD6dh0pExz6YOKKlPv83Hpu7z3w5foSkVCM7ZT+n
TIOIPVnZiwvNxowxe8VdcZN4bwdkbH5GwI7M7O18Mosg+cjBVmTbnUG4UdUQSxk0
6CDYYIm4B6JSssV9Ow1AcDnTe1jcNUWNjhhVOWyp65hYeOgkNQpeoI7jdNl7uad+
hfFrqHXkREDs1nft9RAzqKIFYzHQe/tns0teGZB5dFBh43tZX2XUXKUxsRftyEZw
PWJSCcUB8usaDqcRL3EYg0l5TntyUohV+9ehX2fDHyBmzSdlJoN0OPpyD2ZDH3D4
Y7NA9uQGwakI7+DvLyb3Nxzyo7qEpkO+24z0ZyisiKLaolxeHediQpZE2mYNh31k
+gYYV/20m2/hBwJhLsMgHw811MB2z8fxdxMBL+0WwryFhcjQklLCmrU2aMDh14Wm
8fsO8V8/G39qOepRx76j440vEdCulMOZkrepu+Nk5z/S34FT+joMOrl7iTKGW9WN
lWXy0dkE/3ta1YM3ddHhQumII5HVt01M7LnkzdmZpoGOaklZYG9P7O68eZT+wUFI
6mFMebi9ElH2DFOdTX1x
=HlQ4
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
