Date: Thu, 29 Jan 2015 08:20:58 -0800 From: Michal Zalewski <lcamtuf@...edump.cx> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) The reality is that there probably are hundreds of security bugs that are fixed without CVEs and advisories every year, because of a combination of several things: 1) "Accidental" fixes as a part of code rewrites or design changes, 2) Developers not knowledgeable enough to understand the impact or quickly assess exploitability, 3) Developers being actively opposed to treating security vulnerabilities in a special way, disliking the security community, or wanting to sweep bugs under the rug. In addition to this, even when advisories are written, there are incentives to game the system. Some have an incentive to overhype issues, others to make them go away, and yet others make the world worse by comparing the security of products by counting CVEs. This kind of sucks, but I'm not sure how can we fix this in a practical way. The best approach may be to release and push out new versions of packages far more aggressively, without trying to identify and cherry-pick security updates. This also means causing a lot more breakage, but maybe that's OK. /mz PS. A good chunk of the bugs linked to via http://lcamtuf.coredump.cx/afl/ probably don't have CVEs assigned, probably including most of the security-relevant ones here: https://firstname.lastname@example.org&tag=afl . I actually tried to ping cve-assign@ about the libtiff bugs, but they didn't get back to me.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.