Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE?

["Mike O'Connor" <mjo () dojo mi org>]

:Hello List,
:
:Is it possible to assign a CVE for documented behavior? Communication

Especially in the early days of CVE, some were assigned for documented
behavior.  The one I used to hit the most is CVE-1999-0651, a CVE for
rlogind running (with all sorts of potential for insecurity based on
how it's deployed, but not necessarily insecure in and of itself).  It
would give some folks slaved to CVE-based security-scanning tools fits. 
The scan tool flags a CVE for which nothing can really be done because
it acts as documented.

-- 
 Michael J. O'Connor                                          mjo () dojo mi org
 =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"Security freaks are pretty wierd."                    -Brian Harvey, RFC 686

Attachment: _bin
Description: