[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54345F12.3050503@redhat.com>
Date: Tue, 07 Oct 2014 15:45:54 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: cve-assign@...re.org
Subject: Re: Re: Discussion: information leakage from server
and client software - CVE/hardening/other?
On 07/10/14 02:35 PM, cve-assign@...re.org wrote:
> The main cases in which a CVE could exist are:
>
> 1. The author of the software states that the information-leakage
> behavior was a violation of the product's security policy.
>
> 2. The information-leakage behavior directly contradicts the product's
> documentation stating that the specific information leakage doesn't
> occur.
>
> 3. The author of the software makes no statement, but all (or nearly
> all) similar products follow a standard practice in which the
> information-leakage behavior doesn't occur. For example: common web
> browsers don't send a file: URL in a Referer header.
>
> 4. The author of the software makes no statement, and disclosing the
> information results in no benefit to the user, and the information
> would not be useful to the vendor in further developing the product or
> complying with restrictions on the data that the vendor offers in
> conjunction with the product.
So for example the
http://boingboing.net/2014/10/07/adobe-ebook-drm-secretly-build.html
article would indicate to me that this is CVE worthy under #4 for
example. I also assume that "makes no statement" means the company
actually has to make it easily viewed/available, e.g. not buried in some
huge 60 screen long EULA/TOS, or in some random source code file ("# and
here is where we send information back").
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
