[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110712143945.GA64086@dojo.mi.org>
Date: Tue, 12 Jul 2011 10:39:46 -0400
From: "Mike O'Connor" <mjo@...o.mi.org>
To: oss-security@...ts.openwall.com
Subject: Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE?
:Hello List,
:
:Is it possible to assign a CVE for documented behavior? Communication
Especially in the early days of CVE, some were assigned for documented
behavior. The one I used to hit the most is CVE-1999-0651, a CVE for
rlogind running (with all sorts of potential for insecurity based on
how it's deployed, but not necessarily insecure in and of itself). It
would give some folks slaved to CVE-based security-scanning tools fits.
The scan tool flags a CVE for which nothing can really be done because
it acts as documented.
--
Michael J. O'Connor mjo@...o.mi.org
=--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"Security freaks are pretty wierd." -Brian Harvey, RFC 686
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
