Re: Buffer overflow in /bin/su from UNIX v4

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 3/21/26 11:00, Solar Designer wrote:
> On Sat, Mar 21, 2026 at 01:13:47PM -0400, kf503bla () duck com wrote:
> > why assign cve to something irrelvent?

I was just reporting that it had been assigned, and wasn't part of the
decision to issue it, but CVE's have never been limited to things that
are relevant, and there are many existing irrelevant CVE's already.
CVE's just require that the vulnerability be known - while many people
misuse CVE's as a "things that are important to fix" list, they were
always intended to just be a common name that can be used in discussion.

I'm actually a little surprised this one didn't get the "Unsupported when
assigned" tag that is often given to CVEs for out-of-date software.

> That said, I'm sure there are other cases of historical vulnerabilities
> that never got CVEs.  Some were known prior to the CVE program start, so
> would need CVEs from before 1999.  I think there's some value in that,
> but it would be a change.  CVEs were not assigned for pre-1999 findings
> so far.

If you look at the early CVE-1999 entries you will see some issued for
pre-1999 findings, such as CVE-1999-0129 for a sendmail vulnerability
that CERT published an advisory for in 1996, or CVE-1999-0113 for the
classic rlogin -froot bug that CERT published an advisory for in 1994.
(You'll also find some that would never be issued today, as they're not
bugs in software, but weaknesses in configurations, like having rlogin
enabled, or X11 set to accept unauthenticated connections via 'xhost +'.)

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris