[37792] in bugtraq
Re: DJB's students release 44 *nix software vulnerability advisories
daemon@ATHENA.MIT.EDU (security curmudgeon)
Fri Dec 17 16:55:07 2004
Date: Fri, 17 Dec 2004 02:40:58 -0500 (EST)
From: security curmudgeon <jericho@attrition.org>
To: bugtraq@securityfocus.com
Cc: Thor Larholm <thor@pivx.com>, "D. J. Bernstein" <djb@cr.yp.to>
In-Reply-To: <653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com>
Message-ID: <Pine.LNX.4.61.0412170238210.30571@forced.attrition.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
: Widely deployed open source software is commonly believed to contain
: fewer security vulnerabilities than similar closed source software due
: to the possibility of unrestricted third party source code auditing.
: Predictably, most users of open source software do not invest a
: significant amount of time to audit the applications they use and now a
: class of 25 students has discovered 44 vulnerabilities during a CS
: course.
: D.J. Bernstein (http://cr.yp.to/djb.html) is lecturing a course this
: fall at the University of Illinois at Chicago called "MCS 494: Unix
: Security Holes" (http://cr.yp.to/2004-494.html). One of the requirements
: to pass the course was to find and exploit 10 previously undiscovered
: security holes in currently deployed Unix software.
:
: With a class of 25 students discovering 44 vulnerabilities most students
: now expect to fail the course
: (http://it.slashdot.org/article.pl?sid=04/12/15/2113202).
:
: The 44 security advisories have been published at
:
: http://tigger.uic.edu/~jlongs2/holes/
In each case, Professor Bernstein notified the author of the vulnerable
package on Dec 15 via e-mail. This mail hit Bugtraq on the 16th, giving
one day for vendors to provide fixes.
Is the class on responsible disclosure next semester perhaps?
