Re: pure-ftpd STARTTLS command injection / new CVE?

["Steven M. Christey" <coley () rcf-smtp mitre org>]

CVE's rationale here is that Wietse Venema discovered a class of 
implementation bugs against the same prototol - it's not a vulnerability 
in the protocol itself.  CVE-wise, this situation is not fundamentally 
different from 20+ FTP server implementations that have had buffer 
overflows in the username, or lots of web server directory traversals 
through GET requests (not joking here).  The original publication and CVE 
usage seemed to imply that the CVE would be the same for all 
implementations, but we don't do that except in really really high-volume, 
low-detail situations (e.g. PROTOS SNMP 2002).

- Steve


On Mon, 11 Apr 2011, Mike O'Connor wrote:

> :http://www.pureftpd.org/project/pure-ftpd/news
> :
> :states that pure-ftpd is affected by the same STARTTLS
> :injection bug as postifx's CVE-2011-0411.
> :
> :Is this CVE postfix-specific or can it be used for
> :pure-ftpd as well? If needed, can someone assign a new CVE?
>
> It should get its own CVE assignment.  Other products with the
> same STARTTLS issue have gotten unique CVE assignments for them
> -- see CVE-2011-143[012].
>
> --
> Michael J. O'Connor                                          mjo () dojo mi org
> =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
> "You can't destroy everything.  Where would you sit?"               -The Tick