full-disclosure - Re: How not to deal with a vulnerability in your code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <7543BD71-0C2F-4F0A-9D2B-A1A7E6B43116@visser.name>
Date: Sun, 6 Nov 2011 12:49:00 +1100
From: Jeremy Visser <jeremy@...ser.name>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: How not to deal with a vulnerability in your
	code

On 05/11/2011, at 18:24, Leon Kaiser wrote:
> The flagrant disregard for his userbase is disgusting! I just uninstalled calibre.
> https://bugs.launchpad.net/calibre/+bug/885027/comments/90
> sudo apt-get remove calibre

The comment and "patch" you posted shows you clearly did not read the comments in the bug report.

Ubuntu has already had the bug fixed, because they use a safe udev-based hook. The vulnerability only applies to those who have installed Calibre from source. So "apt-get remove calibre" is a pretty naïve comment to make, but you couldn't resist the bashing, could you?

The reason why he's reinvented the wheel writing the insecure calibre-mount-helper daemon is because there is no platform-agnostic solution for auto-mounting.

Modern Linux distros need a udev hook, older ones need a HAL-based hook, BSD needs HAL, and who knows what everyone else needs.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/