Full Disclosure mailing list archives
Re: How not to deal with a vulnerability in your code
From: Manfred Schmitt <full-disclosure () slashproc org>
Date: Sun, 6 Nov 2011 07:10:52 +0100
Jeremy Visser schrieb:
On 05/11/2011, at 18:24, Leon Kaiser wrote:sudo apt-get remove calibre[...] Ubuntu has already had the bug fixed, because they use a safe udev-based hook. The vulnerability only applies to those who have installed Calibre from source. So "apt-get remove calibre" is a pretty naïve comment to make, but you couldn't resist the bashing, could you?
The thread on launchpad clearly shows (at least for me) that the developer has absolutely no clue about security, so imo the way to go is, even if there are no local root exploits anymore (in upstream), to uninstall it. I'm not that adventurous to wait until it deletes all my user files because he (Maybe, I haven't looked at the source) also reinvented rm ;) Just my 2 Eurocents, Manne _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- How not to deal with a vulnerability in your code Laurelai (Nov 03)
- Re: How not to deal with a vulnerability in your code Jeffrey Walton (Nov 04)
- Re: How not to deal with a vulnerability in your code xD 0x41 (Nov 04)
- Re: How not to deal with a vulnerability in your code Leon Kaiser (Nov 05)
- Re: How not to deal with a vulnerability in your code xD 0x41 (Nov 05)
- Re: How not to deal with a vulnerability in your code Jeremy Visser (Nov 05)
- Re: How not to deal with a vulnerability in your code Manfred Schmitt (Nov 05)
- Re: How not to deal with a vulnerability in your code Jeffrey Walton (Nov 06)
- Re: How not to deal with a vulnerability in your code Leon Kaiser (Nov 08)
- Re: How not to deal with a vulnerability in your code Darren Martyn (Nov 08)