From: Steven M. Christey (coleymitre.org)
Date: Wed Aug 03 2005 - 13:37:42 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

>The release notes for 0.86.2 say:
>
>"Changes in this release include fixes for three possible integer
>overflows in libclamav"

Simply assuming that a single-line changelog entry is sufficient
acknowledgement of a published vulnerability is dangerous. Such
assumptions are frequently wrong. (However, in this case, Alex
Wheeler is credited in the more detailed changelog in the release
notes).

However...

The original advisory said:

  "At least 4 of its file format processors contain remote security
   bugs."

But then the advisory only lists 3 formats.

So, was this just a typo by the researchers? Or are there really 4
bugs, and the latest release still has one bug that hasn't been fixed
yet?

This demonstrates one of the Four I's of security advisory problems,
namely Inconsistency. The other three are Inaccurate, Incomplete, or
Incomprehensible.

- Steve

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]