[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACYkhxjb6ok=8bLcD9zUB0dYA6b84ane_kZy-5JhYyhSB++hOg@mail.gmail.com>
Date: Sun, 22 Mar 2015 15:25:53 +1100
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Cc: Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: CVE for Kali Linux
Hi,
On 22 March 2015 at 13:27, Kurt Seifried <kseifried@...hat.com> wrote:
> So I guess we enter uncharted territory here. So my thought is this:
>
> Vendor has front page that recommends doing something completely insane
> and insecure (http/md5s/etc.). On the back end (good lucking finding
> this) vendor does something sort of secure (gpg signing of packages, no
> clue if key distribution is secure) but this is not really documented well.
Securely distributed md5 and sha1 hashes are just fine against third-party
attackers unless you can think of a way in which an attacker could set up a
collision ahead of time.
There have been attacks against dpkg that work prior to GPG sig checks,
as well as attacks against GPG itself. But then again, TLS stacks aren't
exactly bug-free.
> Does this win a CVE or not? I personally think yes, yes it does.
If any of those circumstances come up, I expect CVEs to be assigned,
but other than that any changes here are just hardening. Something like
http://www.w3.org/TR/SRI/#downloads-1 might be a good start, but I
don't know what the browser takeup is.
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
