full-disclosure - Re: How not to deal with a vulnerability in your code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111106071052.5e65a8de@mobil.bassdart.dyndns.org>
Date: Sun, 6 Nov 2011 07:10:52 +0100
From: Manfred Schmitt <full-disclosure@...shproc.org>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: How not to deal with a vulnerability in your
 code

Jeremy Visser schrieb:

> On 05/11/2011, at 18:24, Leon Kaiser wrote:
> > sudo apt-get remove calibre
> [...]
> Ubuntu has already had the bug fixed, because they use a safe udev-based hook. The vulnerability only applies to those who have installed Calibre from source. So "apt-get remove calibre" is a pretty naïve comment to make, but you couldn't resist the bashing, could you?

The thread on launchpad clearly shows (at least for me) that the developer 
has absolutely no clue about security, so imo the way to go is, even if 
there are no local root exploits anymore (in upstream), to uninstall it.
I'm not that adventurous to wait until it deletes all my user files
because he (Maybe, I haven't looked at the source) also reinvented rm ;)

Just my 2 Eurocents,
Manne

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/