Date: Tue, 07 Oct 2014 15:45:54 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: cve-assign@...re.org Subject: Re: Re: Discussion: information leakage from server and client software - CVE/hardening/other? On 07/10/14 02:35 PM, cve-assign@...re.org wrote: > The main cases in which a CVE could exist are: > > 1. The author of the software states that the information-leakage > behavior was a violation of the product's security policy. > > 2. The information-leakage behavior directly contradicts the product's > documentation stating that the specific information leakage doesn't > occur. > > 3. The author of the software makes no statement, but all (or nearly > all) similar products follow a standard practice in which the > information-leakage behavior doesn't occur. For example: common web > browsers don't send a file: URL in a Referer header. > > 4. The author of the software makes no statement, and disclosing the > information results in no benefit to the user, and the information > would not be useful to the vendor in further developing the product or > complying with restrictions on the data that the vendor offers in > conjunction with the product. So for example the http://boingboing.net/2014/10/07/adobe-ebook-drm-secretly-build.html article would indicate to me that this is CVE worthy under #4 for example. I also assume that "makes no statement" means the company actually has to make it easily viewed/available, e.g. not buried in some huge 60 screen long EULA/TOS, or in some random source code file ("# and here is where we send information back"). -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.