Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 4 Sep 2014 05:13:08 +0000
From: "Christey, Steven M." <coley@...re.org>
To: Kurt Seifried <kseifried@...hat.com>, "oss-security@...ts.openwall.com"
	<oss-security@...ts.openwall.com>
CC: Assign a CVE Identifier <cve-assign@...re.org>
Subject: RE: heap overflow in procmail

Kurt,

>So this is potentially a very bad issue, so I'm assigning a CVE, sorry
>Mitre (safe assumption: they're all tucked away in bed like normal sane
>people =).

That's actually an unsafe assumption, which has introduced a vulnerability into your logic.  There are counter-examples by two different CVE CNA team members in this thread alone.

For additional evidence that counters your assumption, here are a handful of recent oss-security posts by cve-assign between midnight (Eastern time) and 4 AM.  This list is far from complete.
http://www.openwall.com/lists/oss-security/2014/09/02/1
http://www.openwall.com/lists/oss-security/2014/08/13/3
http://www.openwall.com/lists/oss-security/2014/08/13/4
http://www.openwall.com/lists/oss-security/2014/08/13/5
http://www.openwall.com/lists/oss-security/2014/08/14/2
http://www.openwall.com/lists/oss-security/2014/08/14/5
http://www.openwall.com/lists/oss-security/2014/08/15/3

When an issue has been made widely public to the security industry, CNAs are expected to attempt to coordinate more closely with MITRE before assigning a CVE ID themselves.  This helps to reduce confusion and duplicates.  Anything posted to oss-security is considered "widely public."

- Steve

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.