Bugtraq mailing list archives
Re: DJB's students release 44 *nix software vulnerability advisories
From: security curmudgeon <jericho () attrition org>
Date: Fri, 17 Dec 2004 02:40:58 -0500 (EST)
: Widely deployed open source software is commonly believed to contain : fewer security vulnerabilities than similar closed source software due : to the possibility of unrestricted third party source code auditing. : Predictably, most users of open source software do not invest a : significant amount of time to audit the applications they use and now a : class of 25 students has discovered 44 vulnerabilities during a CS : course. : D.J. Bernstein (http://cr.yp.to/djb.html) is lecturing a course this : fall at the University of Illinois at Chicago called "MCS 494: Unix : Security Holes" (http://cr.yp.to/2004-494.html). One of the requirements : to pass the course was to find and exploit 10 previously undiscovered : security holes in currently deployed Unix software. : : With a class of 25 students discovering 44 vulnerabilities most students : now expect to fail the course : (http://it.slashdot.org/article.pl?sid=04/12/15/2113202). : : The 44 security advisories have been published at : : http://tigger.uic.edu/~jlongs2/holes/ In each case, Professor Bernstein notified the author of the vulnerable package on Dec 15 via e-mail. This mail hit Bugtraq on the 16th, giving one day for vendors to provide fixes. Is the class on responsible disclosure next semester perhaps?
Current thread:
- DJB's students release 44 *nix software vulnerability advisories Thor Larholm (Dec 16)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 17)
- Re: DJB's students release 44 *nix software vulnerability advisories cees-bart (Dec 17)
- Re: DJB's students release 44 *nix software vulnerability advisories Marcin Owsiany (Dec 20)
- Re: DJB's students release 44 *nix software vulnerability advisories security curmudgeon (Dec 17)
- Re: DJB's students release 44 *nix software vulnerability advisories Julian T J Midgley (Dec 20)
- <Possible follow-ups>
- Re: DJB's students release 44 *nix software vulnerability advisories D. J. Bernstein (Dec 19)
- Re: DJB's students release 44 *nix software vulnerability advisories Artem Chuprina (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Stephen Samuel (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories D. J. Bernstein (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories David Eisner (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories D. J. Bernstein (Dec 23)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 24)
- Message not available
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 23)