oss-sec mailing list archives
Re: CVE Request -- logrotate -- nine issues
From: "Steven M. Christey" <coley () rcf-smtp mitre org>
Date: Fri, 4 Mar 2011 13:02:38 -0500 (EST)
On Fri, 4 Mar 2011, Solar Designer wrote:
On Fri, Mar 04, 2011 at 12:05:02PM -0500, Steven M. Christey wrote:We will sometimes write the CVE description more as an "adminisrator practice" than as "fault of the software."Oh, this is something I did not realize. A lot of people assume that CVEs "blame" the software and its authors for having made an error.
We do this *if* we are aware of the subtleties. But this often requires an understanding of the expected software behavior, and CVE covers thousands of different applications each year. Unfortunately, we can't have that level of understanding about each app.
It felt wrong, say, to blame a text editor for being unsafe to use on files in untrusted directories when such unsafety was the typical and expected situation for text editors in general.
Some items can be assigned a CVE without deep thought about the larger context. This may happen due to volume, time constraints, or an under-specified attack scenario by the requester. That may be the case with the case you're talking about here, but I don't remember it.
- Steve
Current thread:
- CVE Request -- logrotate -- nine issues Jan Lieskovsky (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steven M. Christey (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steven M. Christey (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Dan Rosenberg (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steve Grubb (Mar 07)
- Re: CVE Request -- logrotate -- nine issues Josh Bressers (Mar 07)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 05)
- Re: CVE Request -- logrotate -- nine issues Florian Zumbiehl (Mar 06)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Steven M. Christey (Mar 04)
- Re: CVE Request -- logrotate -- nine issues Solar Designer (Mar 04)