From owner-freebsd-security Tue Aug 6 2:32:43 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id ACA8B37B400 for ; Tue, 6 Aug 2002 02:32:40 -0700 (PDT) Received: from kagnew.autoloop.com (kagnew.autoloop.com [207.99.30.88]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5536543E42 for ; Tue, 6 Aug 2002 02:32:40 -0700 (PDT) (envelope-from ash@kagnew.autoloop.com) Received: by kagnew.autoloop.com (Postfix, from userid 1000) id 02D0174479; Tue, 6 Aug 2002 09:32:37 +0000 (GMT) Date: Tue, 6 Aug 2002 05:32:37 -0400 From: Anatole Shaw To: Dag-Erling Smorgrav Cc: freebsd-security@freebsd.org Subject: advisory coordination (Re: SA-02:35) Message-ID: <20020806053237.A49851@kagnew.autoloop.com> References: <1028312148.3d4acc54c5eef@webmail.vsi.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from des@ofug.org on Tue, Aug 06, 2002 at 01:19:22AM +0200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, Aug 06, 2002 at 01:19:22AM +0200, Dag-Erling Smorgrav wrote: > Oleg Derevenetz writes: > > I recently visited ftp.freebsd.org, and found directory SA-02:35 in > > CERT/patches without corresponding advisory in CERT/advisories. > SA-02:35 is due out today. We release patches early to make sure > they've propagated to all the mirrors by the time we release the > advisory. In May, I had an exchange with two FreeBSD Security Officers about the release of advisory SA-02:25, which referenced patches that didn't yet exist on the FTP site. I recommended that patches and advisories be made available together. One SO told me that, in the future, patch propagation would be assured prior to advisory release, but that attaching patches to advisories was passe. It seems that this piecemeal bit of change is now in force, with the obvious results. On or before August 2nd, the same problem occured in reverse -- a patch for SA-02:35 (the FFS filesize bug) was propagated without a corresponding advisory, as noted by Oleg above. As a result, there were just about 3 days during which the security patch circulated with no explanation. Those were three days for blackhats to examine the patch, and for exploits to emerge and circulate, before most admins were aware of the bug or its impact. On the same day, Ache@ forwarded an unrelated CVS commit on setlocale.c to this list, adding nonchalantly, "That original BSD code bug can be exploitable." The advisory for this one is still in the works, I guess. I'm all for full-disclosure, but something is very wrong in these 2 cases. Known security problems are being released in fragments without any coordination. It seems that a basic Vulnerability Coordination function is broken or missing, and surely we can fix this. -- Anatole Shaw Autoloop Security Consulting http://www.autoloop.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message