Date: Tue, 6 Aug 2002 05:32:37 -0400 From: Anatole Shaw <shaw@autoloop.com> To: Dag-Erling Smorgrav <des@ofug.org> Cc: freebsd-security@freebsd.org Subject: advisory coordination (Re: SA-02:35) Message-ID: <20020806053237.A49851@kagnew.autoloop.com> In-Reply-To: <xzpado0hp1h.fsf@flood.ping.uio.no>; from des@ofug.org on Tue, Aug 06, 2002 at 01:19:22AM %2B0200 References: <1028312148.3d4acc54c5eef@webmail.vsi.ru> <xzpado0hp1h.fsf@flood.ping.uio.no>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Aug 06, 2002 at 01:19:22AM +0200, Dag-Erling Smorgrav wrote: > Oleg Derevenetz <oleg@vsi.ru> writes: > > I recently visited ftp.freebsd.org, and found directory SA-02:35 in > > CERT/patches without corresponding advisory in CERT/advisories. > SA-02:35 is due out today. We release patches early to make sure > they've propagated to all the mirrors by the time we release the > advisory. In May, I had an exchange with two FreeBSD Security Officers about the release of advisory SA-02:25, which referenced patches that didn't yet exist on the FTP site. I recommended that patches and advisories be made available together. One SO told me that, in the future, patch propagation would be assured prior to advisory release, but that attaching patches to advisories was passe. It seems that this piecemeal bit of change is now in force, with the obvious results. On or before August 2nd, the same problem occured in reverse -- a patch for SA-02:35 (the FFS filesize bug) was propagated without a corresponding advisory, as noted by Oleg above. As a result, there were just about 3 days during which the security patch circulated with no explanation. Those were three days for blackhats to examine the patch, and for exploits to emerge and circulate, before most admins were aware of the bug or its impact. On the same day, Ache@ forwarded an unrelated CVS commit on setlocale.c to this list, adding nonchalantly, "That original BSD code bug can be exploitable." The advisory for this one is still in the works, I guess. I'm all for full-disclosure, but something is very wrong in these 2 cases. Known security problems are being released in fragments without any coordination. It seems that a basic Vulnerability Coordination function is broken or missing, and surely we can fix this. -- Anatole Shaw Autoloop Security Consulting http://www.autoloop.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020806053237.A49851>