[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CVE for ASUS
- To: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
- Subject: CVE for ASUS
- From: Kurt Seifried <kseifried@redhat.com>
- Date: Mon, 6 Jun 2016 12:05:01 -0600
- Authentication-results: spf=none (sender IP is 129.83.29.3) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=redhat.com;mitre.org; dkim=none (message not signed) header.d=none;
- Delivery-date: Tue Jun 7 07:49:43 2016
- List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
- List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
- List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
- List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
- Sender: <owner-cve-editorial-board-list@lists.mitre.org>
- Spamdiagnosticmetadata: 43da9c421be74aed97248473db21fd15
- Spamdiagnosticoutput: 1:2
Timely, ASUS ships a package that defaults to downloading HTTP content and then executing it in a highly trusted way (BIOS/UEFI and more).
I worry that the business case of "download random stuff online and execute it" is becoming increasingly common (hardware vendors, npm, rubygems.org, pypi, containers, etc.) and we're going to see a lot more stuff like this.
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com
- Follow-Ups:
- RE: CVE for ASUS
- From: Common Vulnerabilities & Exposures <cve@mitre.org>
- RE: CVE for ASUS
- Prev by Date: definitions for what is CVE worthy with downloads/installs and containers
- Next by Date: RE: definitions for what is CVE worthy with downloads/installs and containers
- Previous by thread: RE: definitions for what is CVE worthy with downloads/installs and containers
- Next by thread: RE: CVE for ASUS
- Index(es):
