oss-sec mailing list archives
Thoughts on a vuln/CVE?
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 18 Jun 2013 00:04:30 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So I know technically CVEs are for software and not for services. But in this case: =================== http://bits.debian.org/2013/06/remove-debian-multimedia.html The unofficial third party repository Debian Multimedia stopped using the domain debian-multimedia.org some months ago. The domain expired and it is now registered again by someone unknown to Debian. (If we're wrong on this point, please sent us an email so we can take over the domain! ;) ) This means that the repository is no longer safe to use, and you should remove the related entries from your sources.list file. After all, the need of an external repository for multimedia related packages has been greatly reduced with the release of Wheezy, which features many new and updated codecs and multimedia players. Not sure if you're using the debian-multimedia repository? You can easily check it by running: grep -i debian-multimedia.org /etc/apt/sources.list /etc/apt/sources.list.d/* If you can see debian-multimedia.org line in output, you should remove all the lines including it. =================== We have software with a now insecure configuration as it points to a site that may or may not be under attacker control. It seems to me like this might be a candidate for a CVE. Thoughts and comments for and against are welcome (I'm on the fence myself). - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRv/htAAoJEBYNRVNeJnmTq7gP/3jjmPLrs4CHC48Vv4dF4E64 FO8zIcqmr+0pxHNmTc34Yd+5/sCYE25EYe7diAvL0LSv5ZSz4aM8yv+sCaARJFah bYdOr5HIMHNR5x0pl+ysqQL1RVpzArqrYL1NGCeYCxrtxwkvZ85ZxH47Kg3hdvT5 JL0HJyCi8cWGSbnBQce2WUm9rSFtJIIH1hTesewZEi3bJmEJ0fHeti7ZBxMDFLIs EKduQFNZnEZh7juGULf6lp32t9s62A1XgKdubQqoiMk1UKFW2ScEEjgc8frAlo1y POeEvGAEjF9pohfK5jnPjhUW/HcezJPv9ZarA0nGdPPjRVnLqPygN6qPRktklY+f pVb2Zb41CaK0JBvm8fbLv1xifA2d4YitekVTwbsnkv1Jc8actyyC5u2U5GBoeiwr fAlTGCRq0NMQslNygjaifsULBLva3hHYgfm7PejCUpDT/uxfliSurgA6zEMqLOQd GAolEwypDzQCo2Nf4QId8JG22TRFXIH1C00RTSBYsgUECZzhUBs9VMJLKSpGLdxb wZFhpmNBirnbeWbSLRCI+bs9st87ERwmmn12+lESJ3CWRhzwpQJBvKPfWAC+sHqF DyTSsjqcLKV9R1B8pZ8YKKqZ4R1Svo9MYQnkNxTPvm+/DBDUIGeHRd2v4CukrLHX 69/x4Oom1eyYXI42YPE5 =blKB -----END PGP SIGNATURE-----
Current thread:
- Thoughts on a vuln/CVE? Kurt Seifried (Jun 17)
- Re: Thoughts on a vuln/CVE? Yves-Alexis Perez (Jun 17)
- Re: Thoughts on a vuln/CVE? Russ Allbery (Jun 17)
- Re: Thoughts on a vuln/CVE? Moritz Muehlenhoff (Jun 17)
- Re: Thoughts on a vuln/CVE? Kurt Seifried (Jun 17)
- Re: Thoughts on a vuln/CVE? Florian Weimer (Jun 18)
- Re: Thoughts on a vuln/CVE? Simon McVittie (Jun 18)
- Re: Thoughts on a vuln/CVE? Dave Walker (Jun 18)
- Re: Thoughts on a vuln/CVE? Tim (Jun 18)
- Re: Thoughts on a vuln/CVE? Moritz Muehlenhoff (Jun 18)
- Re: Thoughts on a vuln/CVE? Kurt Seifried (Jun 18)
- Re: Thoughts on a vuln/CVE? Kurt Seifried (Jun 17)