Re: vsftpd download backdoored

[Solar Designer <solar () openwall com>]

On Tue, Jul 05, 2011 at 08:30:57PM +0800, Eugene Teo wrote:
> On 07/05/2011 01:25 AM, Solar Designer wrote:
> > On Mon, Jul 04, 2011 at 06:56:57PM +0200, Moritz Muehlenhoff wrote:
> > > IIRC for such backdoored downloads CVE IDs were assigned in the past
> > > to properly track the status of distributions providing the affected 
> > > piece of code.
> >
> > I suspect that no distributions provide the affected code this time.
> > So if affected distributions is the only reason for CVE ID assignment in
> > this case, it might make sense to postpone CVE ID allocation until we
> > learn of an affected distribution (which we probably won't).
>
> But with a CVE name, it is easier for people to refer to this issue, and
> also easier for distributions to publish an official statement.

Your reasoning makes sense to me.

I have no objections to having a CVE ID assigned to this issue, but I
have no idea what the policy is on such assignments.

Alexander