[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <51BFF86E.5010901@redhat.com>
Date: Tue, 18 Jun 2013 00:04:30 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Thoughts on a vuln/CVE?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
So I know technically CVEs are for software and not for services. But
in this case:
===================
http://bits.debian.org/2013/06/remove-debian-multimedia.html
The unofficial third party repository Debian Multimedia stopped using
the domain debian-multimedia.org some months ago. The domain expired
and it is now registered again by someone unknown to Debian. (If we're
wrong on this point, please sent us an email so we can take over the
domain! ;) )
This means that the repository is no longer safe to use, and you
should remove the related entries from your sources.list file.
After all, the need of an external repository for multimedia related
packages has been greatly reduced with the release of Wheezy, which
features many new and updated codecs and multimedia players.
Not sure if you're using the debian-multimedia repository? You can
easily check it by running:
grep -i debian-multimedia.org /etc/apt/sources.list
/etc/apt/sources.list.d/*
If you can see debian-multimedia.org line in output, you should remove
all the lines including it.
===================
We have software with a now insecure configuration as it points to a
site that may or may not be under attacker control. It seems to me
like this might be a candidate for a CVE. Thoughts and comments for
and against are welcome (I'm on the fence myself).
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRv/htAAoJEBYNRVNeJnmTq7gP/3jjmPLrs4CHC48Vv4dF4E64
FO8zIcqmr+0pxHNmTc34Yd+5/sCYE25EYe7diAvL0LSv5ZSz4aM8yv+sCaARJFah
bYdOr5HIMHNR5x0pl+ysqQL1RVpzArqrYL1NGCeYCxrtxwkvZ85ZxH47Kg3hdvT5
JL0HJyCi8cWGSbnBQce2WUm9rSFtJIIH1hTesewZEi3bJmEJ0fHeti7ZBxMDFLIs
EKduQFNZnEZh7juGULf6lp32t9s62A1XgKdubQqoiMk1UKFW2ScEEjgc8frAlo1y
POeEvGAEjF9pohfK5jnPjhUW/HcezJPv9ZarA0nGdPPjRVnLqPygN6qPRktklY+f
pVb2Zb41CaK0JBvm8fbLv1xifA2d4YitekVTwbsnkv1Jc8actyyC5u2U5GBoeiwr
fAlTGCRq0NMQslNygjaifsULBLva3hHYgfm7PejCUpDT/uxfliSurgA6zEMqLOQd
GAolEwypDzQCo2Nf4QId8JG22TRFXIH1C00RTSBYsgUECZzhUBs9VMJLKSpGLdxb
wZFhpmNBirnbeWbSLRCI+bs9st87ERwmmn12+lESJ3CWRhzwpQJBvKPfWAC+sHqF
DyTSsjqcLKV9R1B8pZ8YKKqZ4R1Svo9MYQnkNxTPvm+/DBDUIGeHRd2v4CukrLHX
69/x4Oom1eyYXI42YPE5
=blKB
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
