Re: [gentoo-security] [GLVP 200403-01] Gentoo Linux Pending Vulnerabilities

[Tobias Weisserth]

Hello William,

Am So, den 28.03.2004 schrieb William Kenworthy um 00:49:
> A couple of points:
> Many (Most?) in the list have already been fixed as far as gentoo is
> concerned

Take a look at the corresponding bugzilla entries. All of the things I
compiled into the mail are either "NEW" or "ASSIGNED". NONE of these
issues has been resolved as far as the status in bugzilla is concerned.

Besides: none of these issues has been covered by a GLSA either so I
have to assume - in association with bugzilla status - that the issue is
still alive.

>  - that is if you have followed policy and upgraded the problem
> does not exist in the installed packages.

I have added every issue that might affect any ebuild NOT marked as
"masked" in Portage. This includes older versions of ebuilds that are
still "emergable" without a note from Portage that they may be buggy. I
did so to establish the highest level of "full disclosure" possible to
Gentoo users. After all, not everybody updates software as soon as new
ebuilds are available. Why should a user update from Apache 2.0.47 to
Apache 2.0.49 if he isn't aware of security flaws in 2.0.47 and his
ebuild isn't masked in Portage?

> I think you should:
> A: add a line to say "fixed in later version - upgrade via portage" or
> similar (gotta be a better way to say this!)

I might do this. I already tried to name the affected versions where I
found corresponding informations but most of the time bugzilla entries
don't contain detailed information about versions affected and I didn't
find external references for all issues.

This mail is thought as a reminder to encourage users to check twice and
look for themselves if their version is affected. Seeing their package
in this mail might very much motivate them to do so.

> B: Highlight ones for which the vulnerability is ongoing, that is those
> that have no fix of any kind - top of list?

I have ordered them by priority in bugzilla. Order may change since this
is only a first reminder. There are more things I'll likely change.

> C: give the full package name. Firebird is a name used for both a
> database and a browser, so I had to look twice at that one.

Good :-) So you actually did something for your security :-) If you have
taken a look at the cross reference I gave for the Firebird entry then
you have certainly noticed that quite a lot Firebird products are
affected.

Remember: This mail is not a security advisory in the sense that it
contains solutions or workarounds. It is ought to warn you about
possible problems and encourage you to find out more about them until
the security team has had time to fix them.

> The problem is that if you are on the current x86 (as an example), none
> of these should apply so confusion may occur.  I know its a bit of a
> "play on words", but these are not a "compilation of known but
> unresolved vulnerabilities and security issues in Gentoo Linux."

I have to disagree. Take a look at this:

http://bugs.gentoo.org/buglist.cgi?query_format=&short_desc_type=allwordssubstr&short_desc=&long_desc_type=allwordssubstr&long_desc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&keywords_type=allwords&keywords=&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=VERIFIED&emailassigned_to1=1&emailcc1=1&emailtype1=substring&email1=security%40gentoo.org&emailassigned_to2=1&emailreporter2=1&emailcc2=1&emailtype2=substring&email2=&bugidtype=include&bug_id=&changedin=&chfieldfrom=&chfieldto=Now&chfieldvalue=&field0-0-0=noop&type0-0-0=noop&value0-0-0=&ctype=csv

None of these is "RESOLVED" in bugzilla. All of these are security
related. I'd VERY MUCH call these pending vulnerabilities.

> They
> have been resolved and the packages listed will not/should not be
> installed, but later fixed versions will.

Nonetheless there are many persons who don't update every package as
soon as new ones exist in Portage. Especially people running server
services will most certainly not upgrade if they are unaware of security
issues and their service is running and stable. Including any package
that is still in Portage and not masked is thus necessary. Besides, as
long as a bug exists in bugzilla and hasn't the status "RESOLVED" or
"dropped" I'll keep noting it as a pending vulnerability.

>   Installed systems should have
> been upgraded by the user when the relevant GLSA appears.

None of these issues has been mentioned in a GLSA. That's why I compiled
this mail. Users need to have a clue about issues BEFORE they are fixed
too. They are expected to browse bugzilla. This is complicated and not a
very comfortable thing so I have decided to compile this mail as a
service to the community. My second priority is to watch security
channels as hard as I can and enter the collected issues into bugzilla.
Obviously, Gentoo is missing people doing this.

>   If not ...

GLSA DON'T cover most security issues - yet.

I have collected four more security related issues from full-disclosure
and bugtraq yesterday and today that will be in bugzilla tomorrow. The
situation at the moment seems to be that there are simply not enough
"scouts" who note bugs and make them appear in bugzilla. You can't
expect users to just rely on GLSAs, especially when there are unfixed
bugs in bugzilla that are up to two years old.

Thank you for your suggestions.

kind regards,
Tobias Weisserth




-- 
***************************************************
   ____  _____
  |  _ \| ____| Tobias Weisserth
  | | | |  _|   tobias@weisserth.[de|com|net|org]
 _| |_| | |___  http://www.weisserth.org
(_)____/|_____|
                
Encrypted mail is welcome.
Key and fingerprint: http://imprint.weisserth.org

***************************************************