[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170626003556.GA8994@openwall.com>
Date: Mon, 26 Jun 2017 02:35:57 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory - The Stack Clash
On Wed, Jun 21, 2017 at 02:28:35PM -0700, Qualys Security Advisory wrote:
> On Tue, Jun 20, 2017 at 03:22:04PM +0200, Solar Designer wrote:
> > Qualys, I suggest that, like you did with the Sudo exploit, you publish
> > your Stack Clash exploits in here as soon as third-party exploits of
> > comparable functionality appear, or next Tuesday, whichever is earlier.
>
> We have discussed this internally, and we will first publish the Stack
> Clash exploits and proofs-of-concepts that we sent to the distros@ and
> linux-distros@ lists, plus our Linux ld.so exploit for amd64, and our
> Solaris rsh exploit.
>
> We will do so next Tuesday, but we will publish our Linux exploits and
> proofs-of-concept if and only if Fedora updates are ready by then, our
> NetBSD proof-of-concept if and only if NetBSD patches are ready by then,
> and our FreeBSD proofs-of-concept if and only if FreeBSD patches are
> ready by then.
>
> If someone happens to know of another major distribution that has not
> published patches and updates yet, please let us all know by replying
> here to oss-security. Thank you very much!
Thank you!
We didn't have a specific policy on exploit publication, but for further
occasions I've just added this clarification to:
http://oss-security.openwall.org/wiki/mailing-lists/distros
"If you shared exploit(s) that are not an essential part of the issue
description, then at your option you may slightly delay posting them to
oss-security but you must post the exploits to oss-security within at
most 7 days of making the mandatory posting above. If you exercise this
option, you have two mandatory postings to make: first with a
sufficiently detailed issue description (as requested above) and with an
announcement of your intent to post the exploits separately (please
mention exactly when), and second with the exploits - or indeed you
could have included the exploits right away, in your first and only
mandatory posting."
The decision to wait for fixes in major distros that almost certainly do
intend to release fixes makes sense to me. I haven't found a good way
to specify it as part of policy yet. For now, we may plan to be not as
strict at enforcing the above addition to the policy as I intend to be
at enforcing the main policy of max 14 days for issue detail (possibly
excluding exploits). Specifically, occasional well-reasoned exceptions
where exploits may be posted later than in 7 days may be made - or maybe
we simply need to relax the "at most 7 days" requirement, replacing it
with a higher maximum and a 7 days guideline. Regardless, since this
will be for already-public issues, we'll be able to discuss any such
exceptions or policy changes in public as well - here on oss-security.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
