Re: Thoughts on a vuln/CVE?

[Tim <tim-security () sentinelchicken org>]

> However my original question still stands, can/should we consider a
> common configuration of software that goes from being secure to
> insecure to be worthy of a CVE? A lot of things that used to be common
> practice (like shipping every service/server enabled, all accounts
> active, all access enabled, anonymous uploads allowed, etc.) are now
> seen as security vulnerabilities/exposures.

To me, it's a big grey area as far as assigning a CVE for stuff like
this.

But there's no reason we shouldn't raise awareness through venues like
the various CERTs.  Though it seems US-CERT is only really good at
re-sending microsoft and apple advisories these days. =(

tim