oss-sec mailing list archives
Re: Strange CVE situation (at least one ID should come of this)
From: "Steven M. Christey" <coley () rcf-smtp mitre org>
Date: Tue, 30 Oct 2012 13:34:07 -0400 (EDT)
On 10/26/2012 01:54 PM, Josh Bressers wrote:If I was to list the security problems I found after a few minutes of looking, they are: * It uses MD5 passwords * The shadow file is directly modified without locking (which could lead to a race condition) * If you get the password wrong, it doesn't unlink the empty temporary file. None are really a big deal, you *could* run this and probably never notice these problems. Fundamentally though, this thing should get one CVE ID that basically say "don't use this". How have situations like this been handled in the past?
To have a CVE for "don't use this" is not consistent with long-existing practice. I don't recall ever intentionally assigning a CVE for such a thing - after all, CVE is about vulnerabilities, and "don't use this" is awfully vague.
Deployment of risky software is effectively a configuration or asset management issue, which is well outside the scope of CVE. (Maybe it's more like a Common Configuration Enumeration (CCE) issue.)
In other words - we really shouldn't use CVE to handle this problem. It is feature creep, and I believe that it WOULD become a huge mess. Maybe this would work for some, but not for all of CVE's consumers, which is a wide variety of people and use cases. I understand that there is a problem here, though.
It looks like Josh laid out at least 3 different security issues in your initial request. Those can/should get CVEs assigned, even if there aren't full details. The lack of a vendor CONFIRM reference or advisory, tells the consumer that the vendor hasn't addressed it.
Perhaps the OSS community could borrow an idea from one of the framework vendors with lots of third-party modules - I forget if it was Joomla or Drupal - who actively maintained a list of poorly maintained or obsolete software.
In the broadest sense, however, such old software is still useful for people who are starting in vulnerability research, or just doing it for fun; many people who audit what MITRE calls "phpGolf" applications, go on to do more substantive research.
Perhaps it is time to re-examine Crispin Cowan's Sardonix project, which tried to match vulnerability researchers with open source projects, in order to build reputations for both.
- Steve
Current thread:
- Strange CVE situation (at least one ID should come of this) Josh Bressers (Oct 26)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Seth Arnold (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Steven M. Christey (Oct 30)
- Re: Strange CVE situation (at least one ID should come of this) Henri Salo (Oct 30)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 30)
- Re: [security] [oss-security] Strange CVE situation (at least one ID should come of this) Greg Knaddison (Oct 31)
- Re: Strange CVE situation (at least one ID should come of this) Seth Arnold (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 30)
- Re: Strange CVE situation (at least one ID should come of this) Steven M. Christey (Oct 31)
- Re: Strange CVE situation (at least one ID should come of this) Josh Bressers (Nov 02)
- Re: Strange CVE situation (at least one ID should come of this) cve-assign (Nov 02)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Vincent Danen (Dec 05)