[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <FC72FC641B949240B947AC6F1F83FBAF4C4F6900@IMCMBX01.MITRE.ORG>
Date: Thu, 4 Sep 2014 05:13:08 +0000
From: "Christey, Steven M." <coley@...re.org>
To: Kurt Seifried <kseifried@...hat.com>, "oss-security@...ts.openwall.com"
<oss-security@...ts.openwall.com>
CC: Assign a CVE Identifier <cve-assign@...re.org>
Subject: RE: heap overflow in procmail
Kurt,
>So this is potentially a very bad issue, so I'm assigning a CVE, sorry
>Mitre (safe assumption: they're all tucked away in bed like normal sane
>people =).
That's actually an unsafe assumption, which has introduced a vulnerability into your logic. There are counter-examples by two different CVE CNA team members in this thread alone.
For additional evidence that counters your assumption, here are a handful of recent oss-security posts by cve-assign between midnight (Eastern time) and 4 AM. This list is far from complete.
http://www.openwall.com/lists/oss-security/2014/09/02/1
http://www.openwall.com/lists/oss-security/2014/08/13/3
http://www.openwall.com/lists/oss-security/2014/08/13/4
http://www.openwall.com/lists/oss-security/2014/08/13/5
http://www.openwall.com/lists/oss-security/2014/08/14/2
http://www.openwall.com/lists/oss-security/2014/08/14/5
http://www.openwall.com/lists/oss-security/2014/08/15/3
When an issue has been made widely public to the security industry, CNAs are expected to attempt to coordinate more closely with MITRE before assigning a CVE ID themselves. This helps to reduce confusion and duplicates. Anything posted to oss-security is considered "widely public."
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
