On Fri, 14 Aug 2009, [email protected] wrote:
: Of course, getting a CVE for that issue would have forced disclosure of : the bug too, quite possibly before the vendors were ready to ship Huh? Apparently you don't know how CVE assignment works. If you request one from CVE, they can assign one without knowing any details of the vulnerability. CVE will embargo the details until the researcher and/or vendor are ready. I assume the Candidate Numbering Authorities would be able to do the same, but going to Red Hat, Debian or Ubuntu in this case may not be the best option. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
