Re: Thoughts on a vuln/CVE?

[Moritz Muehlenhoff <jmm () inutil org>]

On Tue, Jun 18, 2013 at 12:04:30AM -0600, Kurt Seifried wrote:

> http://bits.debian.org/2013/06/remove-debian-multimedia.html

[..]

> We have software with a now insecure configuration as it points to a
> site that may or may not be under attacker control. It seems to me
> like this might be a candidate for a CVE. Thoughts and comments for
> and against are welcome (I'm on the fence myself).

No way. This is not an insecure configuration: This was never a Debian 
service and people are free to put whatever they want in /etc/apt/sources.list. 
There are hundreds of external apt sources and everyone of them could have
their owner changed at some point.

Also there's no security issue: If a domain is grabbed and someone configures
an apt repository on the site, he/she would lack the repository key previously
used to sign the repo.

Cheers,
        Moritz