Re: [Full-disclosure] Apache Killer

[Georgi Guninski <guninski@xxxxxxxxxxxx>]

On Thu, Aug 25, 2011 at 03:52:00PM -0400, Valdis.Kletnieks@xxxxxx wrote:
> On Thu, 25 Aug 2011 21:35:04 +0300, Georgi Guninski said:
> > On Wed, Aug 24, 2011 at 10:45:53AM +0100, Mark J Cox wrote:
> > > Use CVE-2011-3192.
> >
> > why the fuck use this shit?
> 
> So that when two different people issue advisories about it, if they both say
> CVE-2011-3192, we know it's the same issue.  Otherwise if you got some people
> writing about Kingcope's hole with gzip and others writing about Zalewski's
> hole with Range: it's hard to tell if they're really the same issue or not.
> 

I am missing something while not feeling like explaining to dummies why cve sux.

Clearly the current thread drama was started by the publication of Kingcope's 
POC.

Zalewski might have something to do with this issue, I don't know.

The IETF RFC is so DOS friendly they have a ticket on it.

As of now (29.08.2011) apache d3v3lop3rs released an advisory not mentioning 
neither Kingcope nor Zalewski and citing the cve sh1t which is VIRTUALLY EMPTY 
as of now - check for yourself (citing empty stuff appears strange to me).

>From the virtually empty cve sh1t I can't tell nothing about the drama.

What did you try to explain or will I have to wait for bright times when usa is 
debt free?

-- 
joro

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/