Date: Thu, 27 Jun 2013 00:13:34 -0600 From: Kurt Seifried <kseifried@...hat.com> To: Russ Allbery <rra@...nford.edu> CC: oss-security@...ts.openwall.com, cve-assign@...re.org, "Steven M. Christey" <coley@...re.org> Subject: Re: 1.2k bug reports for Debian, some may be security -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/26/2013 11:56 PM, Russ Allbery wrote: > Kurt Seifried <kseifried@...hat.com> writes: > >> I will of course be doing CVEs for these (*sob*). In order to >> make this possible though I'm going to need some help in the form >> of good CVE requests in this case I will be fascist. > > I suspect you will not want to be doing CVEs for most of these. > The ones I've seen so far aren't really security issues. They're > cases of command-line programs crashing on input, but usually input > that is not feasibly under the control of an attacker (command-line > options provided by the user, etc.). > > My guess is that the vast majority of these problems are > robustness issues, but are not security issues under any reasonable > threat model that I can think of. > Yup. hence the "Attack outcome (is this a security vulnerability in other words)". I'm hoping <10% of these are security vulnerabilities. But anything setuid/setgid, etc.... all sorts of potential for problems. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRy9gNAAoJEBYNRVNeJnmTJuQP/3MxneL9auzCGqT156Qu0A40 njwYBrJBoMXNi8hPyIMJT1USGIWGpYwW4nMi2cGYWZIZU0w+sfuBpKjqtb6VtNp8 tB53S2+5/J3Cnjo0JJWI3EULDD6dh0pExz6YOKKlPv83Hpu7z3w5foSkVCM7ZT+n TIOIPVnZiwvNxowxe8VdcZN4bwdkbH5GwI7M7O18Mosg+cjBVmTbnUG4UdUQSxk0 6CDYYIm4B6JSssV9Ow1AcDnTe1jcNUWNjhhVOWyp65hYeOgkNQpeoI7jdNl7uad+ hfFrqHXkREDs1nft9RAzqKIFYzHQe/tns0teGZB5dFBh43tZX2XUXKUxsRftyEZw PWJSCcUB8usaDqcRL3EYg0l5TntyUohV+9ehX2fDHyBmzSdlJoN0OPpyD2ZDH3D4 Y7NA9uQGwakI7+DvLyb3Nxzyo7qEpkO+24z0ZyisiKLaolxeHediQpZE2mYNh31k +gYYV/20m2/hBwJhLsMgHw811MB2z8fxdxMBL+0WwryFhcjQklLCmrU2aMDh14Wm 8fsO8V8/G39qOepRx76j440vEdCulMOZkrepu+Nk5z/S34FT+joMOrl7iTKGW9WN lWXy0dkE/3ta1YM3ddHhQumII5HVt01M7LnkzdmZpoGOaklZYG9P7O68eZT+wUFI 6mFMebi9ElH2DFOdTX1x =HlQ4 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.