[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0908051404540.28664@faron.mitre.org>
Date: Wed, 5 Aug 2009 14:13:04 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Matthias Andree <matthias.andree@....de>
cc: oss-security@...ts.openwall.com,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: fetchmail <= 6.3.10 SSL certificate
NUL prefix verification bypass
On Wed, 5 Aug 2009, Matthias Andree wrote:
> - for this problem class (NUL in CN/subjectAltName allows impersonation of
> other sites), add a sort of "umbrella CVE" that will reference the
> individual application CVEs. Would this work?
I am generally wary of assigning umbrella CVEs for implementation bugs
that lots of applications happen to contain at the same time. That's like
giving a single CVE for "FTP server buffer overflow via long USER name" -
which has happened to at least 20 separate implementations in the past.
Generally, the only time that I find umbrella CVEs "tolerable" are during
disclosures that involve massive sets of test cases and lots of
implementations; the PROTOS SNMP disclosures from 2002(?) are the
canonical example.
An umbrella CVE for a fundamental design problem is a different story
because one "developer" made a mistake - the original designer.
So use CVE-2009-2666 for fetchmail (I'll fill it in later) and Tomas, even
if it results in dozens of CVEs, I suspect this is how we should go.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
