Date: Tue, 6 Aug 2002 06:49:40 -0500 From: "Jacques A. Vidrine" <nectar@freebsd.org> To: Anatole Shaw <shaw@autoloop.com> Cc: Dag-Erling Smorgrav <des@ofug.org>, freebsd-security@freebsd.org Subject: Re: advisory coordination (Re: SA-02:35) Message-ID: <20020806114939.GF94762@madman.nectar.cc> In-Reply-To: <20020806053237.A49851@kagnew.autoloop.com> References: <1028312148.3d4acc54c5eef@webmail.vsi.ru> <xzpado0hp1h.fsf@flood.ping.uio.no> <20020806053237.A49851@kagnew.autoloop.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Aug 06, 2002 at 05:32:37AM -0400, Anatole Shaw wrote:
> As a result, there were just about 3 days during which the security patch
> circulated with no explanation. Those were three days for blackhats to
> examine the patch, and for exploits to emerge and circulate, before most
> admins were aware of the bug or its impact.
The bug fix in question was actually in the -CURRENT and -STABLE
branches as many as 6 weeks ago. The commit to the security branches
on July 31 would have been the first indication that there would be
an advisory for the issue. Adding the patch to the FTP site didn't
disclose any further information.
> On the same day, Ache@ forwarded an unrelated CVS commit on setlocale.c to
> this list, adding nonchalantly, "That original BSD code bug can be
> exploitable." The advisory for this one is still in the works, I guess.
He made a mistake (two, actually):
= he meant to mail security-officer@freebsd.org, rather than
security@freebsd.org
= he was wrong ... there was no security issue
> I'm all for full-disclosure, but something is very wrong in these 2 cases.
> Known security problems are being released in fragments without any
> coordination. It seems that a basic Vulnerability Coordination function
> is broken or missing, and surely we can fix this.
I don't think is anything wrong, other than a bit of back-seat
driving. I make plenty of Actual Mistakes for you to pick on if you
like --- this was not one of them. :-)
Cheers,
--
Jacques A. Vidrine <n@nectar.cc> http://www.nectar.cc/
NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos
jvidrine@verio.net . nectar@FreeBSD.org . nectar@kth.se
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020806114939.GF94762>