[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20260321201652.9287-1-justin.swartz@risingedge.co.za>
Date: Sat, 21 Mar 2026 22:16:52 +0200
From: Justin Swartz <justin.swartz@...ingedge.co.za>
To: oss-security@...ts.openwall.com
Cc: justin.swartz@...ingedge.co.za
Subject: Re: Buffer overflow in /bin/su from UNIX v4
Sat, 21 Mar 2026 19:00:13 +0100, Solar Designer wrote:
> On Sat, Mar 21, 2026 at 01:13:47PM -0400, kf503bla@...k.com wrote:
> > why assign cve to something irrelvent?
>
> I guess because (ir)relevance isn't among criteria for (not) assigning a
> CVE, and because there may be value in having a non-ambiguous way to
> refer to historical vulnerabilities for illustration of how the current
> ones fit in historical context.
Beyond the historical context, there is an argument to be made
for being aware of known defects in legacy codebases which have
been resurrected for use on modern resource-constrained hardware.
For example, the RetroBSD [1] project provides a port of 2.11BSD
intended for PIC32 (MIPS) targets. There's also an actively
maintained RetroBSD fork, called DiscoBSD [2], which adds support
for STM32F4 (ARM Cortex-M4) targets and had its last release [3]
last month.
And then there's Serge Vakulenko's LiteBSD [4], a 4.4BSD port to
PIC32.
And who knows where Robert Nordier's port of UNIX V7, v7/x86 [5],
may be running?
While these projects might modernize parts of the kernel and/or
userland, there's always the possibility of bug-ridden code (and
bug-ridden assumptions) being inherited from their respective BSD
and/or Research UNIX lineage - as we've all seen with BSD derived
telnet server and client implementations recently.
Regards,
Justin
--- Links ---
[1] https://retrobsd.org
[2] http://discobsd.org
[3] https://github.com/chettrick/discobsd/releases/tag/DISCOBSD_2_6
[4] https://github.com/sergev/LiteBSD
[5] https://www.nordier.com/#v7x86
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
