[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1103041254480.3265@faron.mitre.org>
Date: Fri, 4 Mar 2011 13:02:38 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: Florian Zumbiehl <florz@...rz.de>,
"Steven M. Christey" <coley@...-smtp.mitre.org>,
Stefan Fritsch <sf@...itsch.de>, Jan Kaluza <jkaluza@...hat.com>,
Paul Martin <pm@...ian.org>, Petr Uzel <petr.uzel@...e.cz>,
Thomas Biege <thomas@...e.de>, Jan Lieskovsky <jlieskov@...hat.com>
Subject: Re: CVE Request -- logrotate -- nine issues
On Fri, 4 Mar 2011, Solar Designer wrote:
> On Fri, Mar 04, 2011 at 12:05:02PM -0500, Steven M. Christey wrote:
>>
>> We will sometimes write the CVE description more as an "adminisrator
>> practice" than as "fault of the software."
>
> Oh, this is something I did not realize. A lot of people assume that
> CVEs "blame" the software and its authors for having made an error.
We do this *if* we are aware of the subtleties. But this often requires
an understanding of the expected software behavior, and CVE covers
thousands of different applications each year. Unfortunately, we can't
have that level of understanding about each app.
> It felt wrong, say, to blame a text editor for being unsafe to use on
> files in untrusted directories when such unsafety was the typical and
> expected situation for text editors in general.
Some items can be assigned a CVE without deep thought about the larger
context. This may happen due to volume, time constraints, or an
under-specified attack scenario by the requester. That may be the case
with the case you're talking about here, but I don't remember it.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
