full-disclosure - Re: [VulnWatch] Sun passwd(1) Command Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200403072308.i27N8sSZ025213@linus.mitre.org>
From: coley at mitre.org (Steven M. Christey)
Subject: Re: [VulnWatch] Sun passwd(1) Command Vulnerability

"Jay D. Dyson" <jdyson@...traq.org> said:

>I often find the grammar used in security advisories and briefs to be
>confusing, and I'm forced to wonder if the wording is deliberate.
>Historically, when security companies have made claims that they could
>not verify, they have been dealt with in a very public, and very
>humilitating fashion, so I rather suspect that meticulous care is put
>in the phrasing without making any brash unverified statements, that
>could cause such embarassment to said company.

In the case of CVE, sometimes we have chosen to "soften" our
descriptions and use phrases such as "may do X" or "possibly has Y
impact" because:

  1) Exploitability is not always easily or immediately proven - at
     least not publicly, anyway.

  2) Vulnerability details are not always known, so one would need to
     put in the effort to figure out the vulnerability before crafting
     the exploit.

  3) Few (if any?) have the resources to prove exploitability/etc. for
     all of the 50+ vulnerabilities that are reported per week.

This seems to be a trend in vulnerability reporting.  In general, I
think it's a good one, i.e. being more open about how much or little
is known at any particular time.  The motives could be more due to
correctness/accuracy than trying to avoid embarrassment.

And if you're a software vendor or maintainer, why spend a large
number of hours trying to prove exploitability?  One could just patch
the bug, post an alert, and move on to other more pressing matters.

- Steve