[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUD-0YmmKLw4CH7MvSu_qB4VRkDawEwuJ52X6UtB-joaig@mail.gmail.com>
Date: Thu, 29 Jan 2015 08:20:58 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)
The reality is that there probably are hundreds of security bugs that
are fixed without CVEs and advisories every year, because of a
combination of several things:
1) "Accidental" fixes as a part of code rewrites or design changes,
2) Developers not knowledgeable enough to understand the impact or
quickly assess exploitability,
3) Developers being actively opposed to treating security
vulnerabilities in a special way, disliking the security community, or
wanting to sweep bugs under the rug.
In addition to this, even when advisories are written, there are
incentives to game the system. Some have an incentive to overhype
issues, others to make them go away, and yet others make the world
worse by comparing the security of products by counting CVEs.
This kind of sucks, but I'm not sure how can we fix this in a
practical way. The best approach may be to release and push out new
versions of packages far more aggressively, without trying to identify
and cherry-pick security updates. This also means causing a lot more
breakage, but maybe that's OK.
/mz
PS. A good chunk of the bugs linked to via
http://lcamtuf.coredump.cx/afl/ probably don't have CVEs assigned,
probably including most of the security-relevant ones here:
https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=jwilk@debian.org&tag=afl
. I actually tried to ping cve-assign@ about the libtiff bugs, but
they didn't get back to me.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
