[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20081103090221.2cbab285@redhat.com>
Date: Mon, 3 Nov 2008 09:02:21 +0100
From: Tomas Hoger <thoger@...hat.com>
To: coley@...us.mitre.org
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2008-4619 / milw0rm6775
Hi Steven!
On Fri, 31 Oct 2008 16:18:36 -0400 (EDT) "Steven M. Christey"
<coley@...us.mitre.org> wrote:
> > Looks like this is a dupe of CVE-2007-0165 after all...
> >
> > http://www.securityfocus.com/bid/21964/
> > http://secunia.com/advisories/23700/
> > http://secunia.com/advisories/32403/
>
> Nothing against these sources but in general CVE wants a solid "logic
> chain" between 2 descriptions before declaring a dupe. In this case
> CVE-2007-0165 is anchored on a very vague description from Sun about
> something in libnsl. CVE-2008-4619 is quite specific. Just because
> it's the same rpcbind service is insufficient as we all know that the
> same package can contain multiple security bugs.
Sorry for not choosing word properly here. I probably should have used
"looks like this *may* be a dupe of...". My reasoning for calling it
dupe was that CVE-2007-0165 links BID-21964, which has the same exploit
attached as is available on milw0rm as 6775. It's not clear when
exploit code was added to the BID, though.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
