[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1104111431270.4424@faron.mitre.org>
Date: Mon, 11 Apr 2011 14:36:51 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: pure-ftpd STARTTLS command injection / new CVE?
CVE's rationale here is that Wietse Venema discovered a class of
implementation bugs against the same prototol - it's not a vulnerability
in the protocol itself. CVE-wise, this situation is not fundamentally
different from 20+ FTP server implementations that have had buffer
overflows in the username, or lots of web server directory traversals
through GET requests (not joking here). The original publication and CVE
usage seemed to imply that the CVE would be the same for all
implementations, but we don't do that except in really really high-volume,
low-detail situations (e.g. PROTOS SNMP 2002).
- Steve
On Mon, 11 Apr 2011, Mike O'Connor wrote:
> :http://www.pureftpd.org/project/pure-ftpd/news
> :
> :states that pure-ftpd is affected by the same STARTTLS
> :injection bug as postifx's CVE-2011-0411.
> :
> :Is this CVE postfix-specific or can it be used for
> :pure-ftpd as well? If needed, can someone assign a new CVE?
>
> It should get its own CVE assignment. Other products with the
> same STARTTLS issue have gotten unique CVE assignments for them
> -- see CVE-2011-143[012].
>
> --
> Michael J. O'Connor mjo@...o.mi.org
> =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
> "You can't destroy everything. Where would you sit?" -The Tick
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
