full-disclosure - Re: Apache Killer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6822.1314373457@turing-police.cc.vt.edu>
Date: Fri, 26 Aug 2011 11:44:17 -0400
From: Valdis.Kletnieks@...edu
To: Georgi Guninski <guninski@...inski.com>
Cc: full-disclosure@...ts.grok.org.uk, Mark J Cox <mjc@...che.org>
Subject: Re: Apache Killer

On Fri, 26 Aug 2011 16:19:31 +0300, Georgi Guninski said:
> ok, there might be some sense in using canonical names,
> but why chose possibly the worst service available?

"possibly" doesn't mean much unless you have an actual point to make.

> from their front page: "CVE®" - remember, remember what happened with the
>  securityfocus/bugtraq exploit DB?

I doubt Mitre has any such plans - the "®" is there mostly so they can take
action against people who invent their own CVE numbers.

> btw, all the shitty id that should be "used" says:

> ** RESERVED ** This candidate has been reserved by an organization or
> individual that will use it when announcing a new security problem. When the
> candidate has been publicized, the details for this candidate will be
> provided.

I beleive those are pools allocated to the various CVE Numbering Authorities:

https://cve.mitre.org/cve/cna.html#participating_cnas

Each of those vendors and researchers has a small pool of pre-assigned numbers
they can use - so if Apple or Microsoft gets notified of a vulnerability, they
can peel off the next number from their pool and use it without the delay of
going back to Mitre to get a number assigned.

It usually *doesn't* mean people are sitting on unannounced stuff - it means
people are sitting on numbers to use quickly if they have to make an
announcement.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/