full-disclosure - Re: Mr. Magorium's Wunderbar Emporium

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0908150705100.30063@forced.attrition.org>
Date: Sat, 15 Aug 2009 07:07:53 +0000 (UTC)
From: security curmudgeon <jericho@...rition.org>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk, dailydave@...ts.immunitysec.com
Subject: Re: Mr. Magorium's Wunderbar Emporium

On Fri, 14 Aug 2009, Valdis.Kletnieks@...edu wrote:

: Of course, getting a CVE for that issue would have forced disclosure of 
: the bug too, quite possibly before the vendors were ready to ship 

Huh? Apparently you don't know how CVE assignment works.

If you request one from CVE, they can assign one without knowing any 
details of the vulnerability. CVE will embargo the details until the 
researcher and/or vendor are ready. I assume the Candidate Numbering 
Authorities would be able to do the same, but going to Red Hat, Debian or 
Ubuntu in this case may not be the best option.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/