Re: CVE for Kali Linux

[Michael Samuel <mik () miknet net>]

Hi,

On 22 March 2015 at 13:27, Kurt Seifried <kseifried () redhat com> wrote:
> So I guess we enter uncharted territory here. So my thought is this:
>
> Vendor has front page that recommends doing something completely insane
> and insecure (http/md5s/etc.). On the back end (good lucking finding
> this) vendor does something sort of secure (gpg signing of packages, no
> clue if key distribution is secure) but this is not really documented well.

Securely distributed md5 and sha1 hashes are just fine against third-party
attackers unless you can think of a way in which an attacker could set up a
collision ahead of time.

There have been attacks against dpkg that work prior to GPG sig checks,
as well as attacks against GPG itself.   But then again, TLS stacks aren't
exactly bug-free.

> Does this win a CVE or not? I personally think yes, yes it does.

If any of those circumstances come up, I expect CVEs to be assigned,
but other than that any changes here are just hardening.  Something like
http://www.w3.org/TR/SRI/#downloads-1 might be a good start, but I
don't know what the browser takeup is.

Regards,
  Michael