Full Disclosure mailing list archives
Re: Mr. Magorium's Wunderbar Emporium
From: Valdis.Kletnieks () vt edu
Date: Sun, 16 Aug 2009 02:43:10 -0400
On Sat, 15 Aug 2009 07:07:53 -0000, security curmudgeon said:
On Fri, 14 Aug 2009, Valdis.Kletnieks () vt edu wrote: : Of course, getting a CVE for that issue would have forced disclosure of : the bug too, quite possibly before the vendors were ready to ship Huh? Apparently you don't know how CVE assignment works. If you request one from CVE, they can assign one without knowing any details of the vulnerability. CVE will embargo the details until the researcher and/or vendor are ready. I assume the Candidate Numbering Authorities would be able to do the same, but going to Red Hat, Debian or Ubuntu in this case may not be the best option.
Yes, but to make the CVE actually *useful*, they need to eventually release it. Sure, I may have 5 or 10 CAN in my pocket - and I can even wave around CAN-2009-3439 and say 'Death of Internet Predicted'. But for the CAN/CVE to be *useful*, it needs to be disclosed.
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Mr. Magorium's Wunderbar Emporium Brad Spengler (Aug 14)
- Re: Mr. Magorium's Wunderbar Emporium Valdis . Kletnieks (Aug 14)
- Re: Mr. Magorium's Wunderbar Emporium security curmudgeon (Aug 15)
- Re: Mr. Magorium's Wunderbar Emporium Valdis . Kletnieks (Aug 15)
- Re: Mr. Magorium's Wunderbar Emporium Valdis' Mustache (Aug 16)
- Re: Mr. Magorium's Wunderbar Emporium security curmudgeon (Aug 15)
- Re: Mr. Magorium's Wunderbar Emporium Pavel Kankovsky (Aug 15)
- Re: Mr. Magorium's Wunderbar Emporium Valdis . Kletnieks (Aug 14)