Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less

[Raphael Geissert <geissert () debian org>]

On 17 November 2014 13:33, Hanno Böck <hanno () hboeck de> wrote:
[...]
> What should we do with that?
> a) is it an unappropriate use of less to view untrusted files and we
> should teach users so? (I seriously never would've thought of that - and
> which average "just learned how to use the shell" user would've?)
> b) tell linux distros that lesspipe is insecure and shouldn't be
> enabled?
> c) fuzz all the tools in there and report at least the
> low-hanging-fruit-bugs? (and then maybe try to replace the
> "they-don't-fix-bugs-or-don't-have-a-dev-any-more"-tools with more
> secure ones)

d) acknowledge the fact that most tools were not "designed for
security" and that we should talk about mitigation. It's about risk
analysis.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net