[Secure-testing-team] DTSA for 2.6.8 and 2.4.27

[Micah Anderson]

Moritz Muehlenhoff schrieb am Friday, den 09. September 2005:

> Micah Anderson wrote:
> > Neither of these advisories is a typical DTSA, as we normally we only do
> > advisories for things that are blocked from reaching testing by some other
> > issue, but I think that it would be good to do these two advisories because
> > of the sheer number of security holes fixed as well as the necessary upgrade
> > path that people need to take if they wish to maintain the integrity of
> > their machines.
> 
> Good idea, but I'd suggest to make a clean-sweep run over all kernel
> issues before. Some entries definitely need updating, (wrt to 2.4/2.6

You mean cross reference all the entries in CAN/list to make sure there
isn't anything missing or still has a TODO label?

> mapping and IIRC Horms has some mails pending as well, he told me some days
> ago. 

I'll check with horms about any additional pending fixes.

> Also several more issues should receive a CVE mapping.

What do you refer to here? 

I was thinking that the issues that do not have CVE numbers should possibily
be submitted so that they do, although I'm not sure how long that will take
and if it is worth holding up an advisory.

> Wrt keeping a complete history we should also move the entries based on
> older kernel-source packages to linux-2.6, as this will be the new
> permanent source package for 2.6 kernels.

I'm not following you here -- do you mean change all the entries in CAN/list
that are for kernel-source-#.#.# to be linux-2.6? If so, why?

Thanks!
Micah