Re: vsftpd download backdoored

[Eugene Teo <eugene () redhat com>]

On 07/05/2011 01:25 AM, Solar Designer wrote:
> On Mon, Jul 04, 2011 at 06:56:57PM +0200, Moritz Muehlenhoff wrote:
> > IIRC for such backdoored downloads CVE IDs were assigned in the past
> > to properly track the status of distributions providing the affected 
> > piece of code.
>
> I suspect that no distributions provide the affected code this time.
> So if affected distributions is the only reason for CVE ID assignment in
> this case, it might make sense to postpone CVE ID allocation until we
> learn of an affected distribution (which we probably won't).

But with a CVE name, it is easier for people to refer to this issue, and
also easier for distributions to publish an official statement.

My two cents.

Eugene