[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Mr. Magorium's Wunderbar Emporium
- To: Valdis.Kletnieks@xxxxxx
- Subject: Re: [Full-disclosure] Mr. Magorium's Wunderbar Emporium
- From: security curmudgeon <jericho@xxxxxxxxxxxxx>
- Date: Sat, 15 Aug 2009 07:07:53 +0000 (UTC)
On Fri, 14 Aug 2009, Valdis.Kletnieks@xxxxxx wrote:
: Of course, getting a CVE for that issue would have forced disclosure of
: the bug too, quite possibly before the vendors were ready to ship
Huh? Apparently you don't know how CVE assignment works.
If you request one from CVE, they can assign one without knowing any
details of the vulnerability. CVE will embargo the details until the
researcher and/or vendor are ready. I assume the Candidate Numbering
Authorities would be able to do the same, but going to Red Hat, Debian or
Ubuntu in this case may not be the best option.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/