[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LFD.2.10.1402201123001.18439@wniryva.cad.erqung.pbz>
Date: Thu, 20 Feb 2014 11:57:19 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
cc: cve-assign@...re.org
Subject: Re: Re: CVE Request New-djbdns: dnscache: potential
cache poisoning
+-- On Wed, 19 Feb 2014, cve-assign@...re.org wrote --+
| traditional sense. Yes, we realize that there's a potentially
| important and potentially simple attack possibility that could have
| been avoided by not choosing djb33. That's not sufficient, however.
What do you mean not sufficient?
| Also, in this case, some aspects of making a better choice (e.g., with
| sufficiently fast and auditable pseudorandom hashing code) were
| probably not even understood in the research community at the time the
| software was originally written.
I don't understand. How is it relevant that it was not well understood at
the time when software was written? It is still an issue. And that argument
could be true for many other issues. Like the JSON library example earlier
in this thread, or
-> http://www.cvedetails.com/cve/CVE-2012-0770
-> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885
| CVE does, as a secondary form of inclusion, cover vulnerability
| advisories from a vendor who was the original author of a piece of
| software and publishes a change as a required security update. That is
| unlikely here; nobody is anticipating djbdns-1.06.
Woh..woh..woh!!! Please note that the CVE is requested for 'New-djbdns'.
New-djbdns is a fully fledged, production quality, fast growing fork of
the 'djbdns'.
New-djbdns -> http://pjp.dgplug.org/ndjbdns/
I am the upstream developer and Fedora package maintainer of this project. I
assure you, version 1.06 is brewing and brewing good. It'll be served when it
is ready.
I request you to kindly assign a CVE for this and the other issue in
New-djbdns. Lot of users depend of it.
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
