Secunia pages -- publishing wrong and misleading information about security status of Fedora distros?? RE: [Fedora Project Wiki] Update of "Security" by JoshBressers (fwd)

[David Eisenstein]

Hi,

Was noticing one of Josh Bresser's edits to wiki/Security today...  (see
the forward below).

If Secunia's information is incorrect and misleading, misrepresenting the
true security status of Fedora distributions, oughtn't we get in touch
with Secunia to help coordinate updating their information to make it
correct and informative?

They claim to welcome feedback:

   "If you have new information regarding a Secunia advisory or a
   product in our database, please send it to us using either our web
   form or email us at vuln(a)secunia.com.

   "Ideas, suggestions, and other feedback is most welcome."

It seems that Secunia may be doing us a service, putting a lot of work
into informing the public of details about the security status of various
Linux distros including Fedora -- work we may not have time to do and so
are not doing at the moment.  Perhaps we can support their work rather
than just putting our heads in the sand and pretending it's not there
misrepresenting the security status?

(a little later) 

Okay, now I've actually *looked* at Secunia's pages...  Hrm.  It looks
like Secunia only talks about issues that have releases published, and
then only from the fedora-announce-list.  They have nothing in their pages
about vulnerabilities fixed by Fedora Legacy.  (For example, see
<http://secunia.com/graph/?type=adv&period=all&prod=2568> for FC1, which
Fedora Legacy continues to maintain.)

And, since it appears they're only reporting from announcements of fixed
packages, of course their little pie charts would show 100% fixed.  (For
example, see <http://secunia.com/graph/?type=sol&period=all&prod=5251> for
Fedora Core 4.)  It looks like they're doing no original research at all
(like looking at CVE's from cve.mitre.org) to see if distros have any
unpatched vulnerabilities ...

Does Secunia have folks that can be worked with so their Fedora pages can
become reliable enough so we *can* have them linked to as a third-party
site in our wiki??  And further, do any of us who work with security
issues have *time* to invest in working with them to bring them in line
with reality, assuming they're open to suggestions?

	Regards,
	David Eisenstein

---------- Forwarded message ----------
From: fedorawiki-noreply(a)fedoraproject.org
To: fedorawiki-noreply(a)fedoraproject.org
Date: Fri, 03 Mar 2006 22:32:50 -0000
Subject: [Fedora Project Wiki] Update of "Security" by JoshBressers

Dear Wiki user,

You have subscribed to a wiki page or wiki category on "Fedora Project Wiki" for
change notification.

The following page has been changed by JoshBressers:
http://fedoraproject.org/wiki/Security

The comment on the change is:
The secunia pages are very wrong and misleading.

------------------------------------------------------------------------------
@@ -38, +38 @@

  
  * http://fedoraproject.org/wiki/Presentations
  
- == Third-Party Information ==
- 
- Secunia:
-  * [http://secunia.com/product/5251/ Secunia's Vulnerability Report for Fedora Core
4]
-  * [http://secunia.com/product/4222/ Secunia's Vulnerability Report for Fedora Core
3]
-  * [http://secunia.com/product/3489/ Secunia's Vulnerability Report for Fedora Core
2]
-  * [http://secunia.com/product/2568/ Secunia's Vulnerability Report for Fedora Core
1]
-  * [http://secunia.com/vendor/3/ Secunia's Red Hat vendor page]
- 
  ----
  CategoryDocumentation CategorySecurity

[Josh Bressers]

>  Was noticing one of Josh Bresser's edits to wiki/Security
> today...  (see
>  the forward below).
>  
>  If Secunia's information is incorrect and misleading, misrepresenting the
>  true security status of Fedora distributions, oughtn't we get in touch
>  with Secunia to help coordinate updating their information to make it
>  correct and informative? 
I would dare to say it's not worth the effort.  The problem becomes who do
you decide to feed information to and who don't you?  There are many
organizations like secunia that try to represent security information to
the public at large.  I think the best way to show describe security issues
to the Fedora community would be to write a script or two to parse these
files:

http://cvs.fedora.redhat.com/viewcvs/fedora-security/audit/fc4?root=fedor...
http://cvs.fedora.redhat.com/viewcvs/fedora-security/audit/fc5?root=fedor...

These are where the security response team tracks every public issue we're
aware of that affects Core.

I'm open to suggests and ideas from anyone who wants to parse this file.
One of the problem is how to display this information in a sensible manner
that doesn't overload a normal person.

These files do have a lack of bugzilla ID, as almost 100% of the issues in
FC4 should have a bugzilla entry.  There are certain things we do with
bugzilla to help capture information.  The things in FC5 don't always as
the version upgrade as part of distribution creation fixes many issues.

Let's look at bug 182416

The first thing you will probably notice is the CVE id is in the summary.
This makes it very easy to see which issues are which when we do a bug
listing.  This also means you can view the CVE information here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0528

The severity is of course "security".  The "Status Whiteboard" is
possibly the most interesting thing we keep in a bug.  This is also a field
one would want to parse with a security reporting tool.

source=cve,reported=20060202,impact=important,public=20060128

This tells us we found out about this issue when MITRE made not of it in
their database (cve.mitre.org/cve).  It's one of the many many things we
spy on to stay ahead of the wave.

We found the issue on 2006-02-02 (reported).
We have classified the issue as "Important":
http://www.redhat.com/security/updates/classification/

And the issue was known to the public at large on 2006-01-28.

Let me know if there are any questions.

I should probably find some time to put all this into a wiki page.

-- 
    JB