Re: Apache Killer

[Georgi Guninski <guninski () guninski com>]

On Thu, Aug 25, 2011 at 03:52:00PM -0400, Valdis.Kletnieks () vt edu wrote:
> On Thu, 25 Aug 2011 21:35:04 +0300, Georgi Guninski said:
> > On Wed, Aug 24, 2011 at 10:45:53AM +0100, Mark J Cox wrote:
> > > Use CVE-2011-3192.
> >
> > why the fuck use this shit?
>
> So that when two different people issue advisories about it, if they both say
> CVE-2011-3192, we know it's the same issue.  Otherwise if you got some people
> writing about Kingcope's hole with gzip and others writing about Zalewski's
> hole with Range: it's hard to tell if they're really the same issue or not.

I am missing something while not feeling like explaining to dummies why cve sux.

Clearly the current thread drama was started by the publication of Kingcope's POC.

Zalewski might have something to do with this issue, I don't know.

The IETF RFC is so DOS friendly they have a ticket on it.

As of now (29.08.2011) apache d3v3lop3rs released an advisory not mentioning neither Kingcope nor Zalewski and citing 
the cve sh1t which is VIRTUALLY EMPTY as of now - check for yourself (citing empty stuff appears strange to me).

> From the virtually empty cve sh1t I can't tell nothing about the drama.

What did you try to explain or will I have to wait for bright times when usa is debt free?

-- 
joro

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/