Date: Sun, 22 Mar 2015 15:25:53 +1100 From: Michael Samuel <mik@...net.net> To: oss-security@...ts.openwall.com Cc: Assign a CVE Identifier <cve-assign@...re.org> Subject: Re: CVE for Kali Linux Hi, On 22 March 2015 at 13:27, Kurt Seifried <kseifried@...hat.com> wrote: > So I guess we enter uncharted territory here. So my thought is this: > > Vendor has front page that recommends doing something completely insane > and insecure (http/md5s/etc.). On the back end (good lucking finding > this) vendor does something sort of secure (gpg signing of packages, no > clue if key distribution is secure) but this is not really documented well. Securely distributed md5 and sha1 hashes are just fine against third-party attackers unless you can think of a way in which an attacker could set up a collision ahead of time. There have been attacks against dpkg that work prior to GPG sig checks, as well as attacks against GPG itself. But then again, TLS stacks aren't exactly bug-free. > Does this win a CVE or not? I personally think yes, yes it does. If any of those circumstances come up, I expect CVEs to be assigned, but other than that any changes here are just hardening. Something like http://www.w3.org/TR/SRI/#downloads-1 might be a good start, but I don't know what the browser takeup is. Regards, Michael
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.