Home page logo

oss-sec logo oss-sec mailing list archives

Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE?
From: "Mike O'Connor" <mjo () dojo mi org>
Date: Tue, 12 Jul 2011 10:39:46 -0400

:Hello List,
:Is it possible to assign a CVE for documented behavior? Communication

Especially in the early days of CVE, some were assigned for documented
behavior.  The one I used to hit the most is CVE-1999-0651, a CVE for
rlogind running (with all sorts of potential for insecurity based on
how it's deployed, but not necessarily insecure in and of itself).  It
would give some folks slaved to CVE-based security-scanning tools fits. 
The scan tool flags a CVE for which nothing can really be done because
it acts as documented.

 Michael J. O'Connor                                          mjo () dojo mi org
"Security freaks are pretty wierd."                    -Brian Harvey, RFC 686

Attachment: _bin

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]