Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: How not to deal with a vulnerability in your code
From: Darren Martyn <d.martyn.fulldisclosure () gmail com>
Date: Tue, 8 Nov 2011 13:53:32 +0000

At least we can see the code and the fuckups freely... Unlike with some
OS's...

On Sun, Nov 6, 2011 at 1:56 AM, Leon Kaiser <literalka () gmail com> wrote:

**
Of course I couldn't resist!

  --
========================================================
*Leon Kaiser*      - Head of GNAA Public Relations -
        literalka () gnaa eu || literalka () goatse fr
       http://gnaa.eu || http://security.goatse.fr
      7BEECD8D FCBED526 F7960173 459111CE 
F01F9923<http://pgp.mit.edu:11371/pks/lookup?op=vindex&fingerprint=on&search=0x459111CEF01F9923>
"The mask of anonymity is not intensely constructive."
       -- Andrew "weev" Auernheimer
========================================================

  On Sun, 2011-11-06 at 12:49 +1100, Jeremy Visser wrote:

On 05/11/2011, at 18:24, Leon Kaiser wrote:
The flagrant disregard for his userbase is disgusting! I just uninstalled calibre.
https://bugs.launchpad.net/calibre/+bug/885027/comments/90
sudo apt-get remove calibre

The comment and "patch" you posted shows you clearly did not read the comments in the bug report.

Ubuntu has already had the bug fixed, because they use a safe udev-based hook. The vulnerability only applies to 
those who have installed Calibre from source. So "apt-get remove calibre" is a pretty naïve comment to make, but you 
couldn't resist the bashing, could you?

The reason why he's reinvented the wheel writing the insecure calibre-mount-helper daemon is because there is no 
platform-agnostic solution for auto-mounting.

Modern Linux distros need a udev hook, older ones need a HAL-based hook, BSD needs HAL, and who knows what everyone 
else needs.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




-- 
My Homepage :D <http://compsoc.nuigalway.ie/%7Einfodox>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]