bugtraq - Re: DJB's students release 44 *nix software vulnerability advisories

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.61.0412170238210.30571@forced.attrition.org>
Date: Fri, 17 Dec 2004 02:40:58 -0500 (EST)
From: security curmudgeon <jericho@...rition.org>
To: bugtraq@...urityfocus.com
Cc: Thor Larholm <thor@...x.com>, "D. J. Bernstein" <djb@...yp.to>
Subject: Re: DJB's students release 44 *nix software vulnerability advisories

: Widely deployed open source software is commonly believed to contain 
: fewer security vulnerabilities than similar closed source software due 
: to the possibility of unrestricted third party source code auditing. 
: Predictably, most users of open source software do not invest a 
: significant amount of time to audit the applications they use and now a 
: class of 25 students has discovered 44 vulnerabilities during a CS 
: course.

: D.J. Bernstein (http://cr.yp.to/djb.html) is lecturing a course this 
: fall at the University of Illinois at Chicago called "MCS 494: Unix 
: Security Holes" (http://cr.yp.to/2004-494.html). One of the requirements 
: to pass the course was to find and exploit 10 previously undiscovered 
: security holes in currently deployed Unix software.
: 
: With a class of 25 students discovering 44 vulnerabilities most students 
: now expect to fail the course 
: (http://it.slashdot.org/article.pl?sid=04/12/15/2113202).
: 
: The 44 security advisories have been published at
: 
: http://tigger.uic.edu/~jlongs2/holes/

In each case, Professor Bernstein notified the author of the vulnerable 
package on Dec 15 via e-mail. This mail hit Bugtraq on the 16th, giving 
one day for vendors to provide fixes.

Is the class on responsible disclosure next semester perhaps?