3 ms·

"The Security Advisory did not contain information on the theoretical implications of the vulnerability. A more explicit paragraph in the 'Impact' statement may

"The Security Advisory did not contain information on the theoretical implications of the vulnerability. A more explicit paragraph in the 'Impact' statement may have been warranted." I may be overreacting on this, but this sounds like "you who found bugs in our code: document them better next time". I think the reporter does not owe freebsd anything. If someone owes someone else something, freebsd developers should thank the reporter for finding those vulnerabilities, and not ask for even more of him.

g_p 10y ago
I read it to mean something different; I think the advisory being referred to is the FreeBSD advisory they wrote themselves [1]. The impact statement said: > An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root. I suspect this is where they feel that in future they would perhaps have been better to mention the implication of this, given bspatch is used in the update process users will run in response to the advisory. [1] https://www.freebsd.org/security/advisories/FreeBSD-SA-16%3A25.bspatch.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-16%3A...
Tomte 10y ago
The Security Advisory was written by FreeBSD. They are saying that they could have been more explicit in explaining to their users what the vulnerability means.
stonogo 10y ago
You are undoubtedly overreacting. They are talking about their own announcement, not the initial disclosure. This is 'Impact' statement from the Security Advisory in question: > An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root. Their criticism is of their own work, not of the researcher.
schwarze_pest 10y ago
Aehm, what are you talking about? Maybe you should read the mail again.

g_p 10y ago

I read it to mean something different; I think the advisory being referred to is the FreeBSD advisory they wrote themselves [1]. The impact statement said: > An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root. I suspect this is where they feel that in future they would perhaps have been better to mention the implication of this, given bspatch is used in the update process users will run in response to the advisory. [1] https://www.freebsd.org/security/advisories/FreeBSD-SA-16%3A25.bspatch.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-16%3A...

Tomte 10y ago

The Security Advisory was written by FreeBSD. They are saying that they could have been more explicit in explaining to their users what the vulnerability means.

stonogo 10y ago

You are undoubtedly overreacting. They are talking about their own announcement, not the initial disclosure. This is 'Impact' statement from the Security Advisory in question: > An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root. Their criticism is of their own work, not of the researcher.

schwarze_pest 10y ago

Aehm, what are you talking about? Maybe you should read the mail again.