4

For most open source project, there is a well-founded project team and corporate sponsorship, and a lot of active contributors. The procedure for filing bug reports are clearly documented.

However, there are also some open source project(s) that have been in existence for more than 10 years (maybe 15), and were included in all sorts of free and commercial products (OSes and linux distros, etc), and everyone just assumes it is correct, despite some parts of it in a state of despair and full of bugs.

It appears to me that the real users (programmers in-the-know) simply choose to use the library in a certain way as not to trigger the bug. Few choose to speak up.

There are also big-name companies that fix the bugs quietly (in their own products) without giving out any patches. And use that to their business advantage.

There is no leading developer. There is no information as to who are the active developers, except that you can browse the mailing list and see who has recently submitted patches, and assume that they might know someone who is helpful.

How should I handle a vulnerability case, without leaking information in a way that gives ammunition to the bad guys?

This question is a spin-off from: https://softwareengineering.stackexchange.com/questions/5168/whats-the-biggest-software-security-vulnerabilty-youve-personally-discovered

Improve this question

4 Answers 4

Reset to default
4

Talk to Secunia (or any of the other bug databases), and let them handle it.

They do this on a daily basis, and probably already have a procedure for if they can't identify an appropriate contributor for a project.

(I would guess, if there's no contacts for the library itself, they'd contact major projects currently using the library, allowing any widespread software to fix/workaround any security issues, before releasing details to the public.)

Improve this answer
1
  • Your advice seems to be relevant to my case. I'll wait for some more inputs from other people before I accept your answer, but I'll probably contact them right away. (Part of the frustration comes from knowing how to trigger the bug but not being able to create a fix for it.)
    – rwong
    Oct 18, 2010 at 11:23
1

To the coordinator(s).

If there is no clear info, I suggest you to pick one random contributor and ask him who is in charge.

Pick another contributor until you have a clear answer.

In any case, send the details about the problem to each person you contact.

Improve this answer
2
  • I cannot find the real email addresses of any contributors. If I email the list directly, the contents are posted online immediately, risking disclosure.
    – rwong
    Oct 18, 2010 at 9:24
  • Then you are screwed. I wouldn't invest any more time in a project like that if I was you.
    – user2567
    Oct 18, 2010 at 9:27
1

If the project is open source, then I don't see a problem posting your findings directly to the mailing list. Particularly if you have a patch already (but even if you didn't). If managed to tell someone about it "privately", as soon as they committed the fix to the repo (which I assume is public as well) everybody would know anyway.

Improve this answer
0

Report the bug and if noone cares then clone the repository on github and fix the error there, and point to that repository in the original bugreport so others can get a fixed version.

Remember to merge the clone regularily to pick up other fixes.

Improve this answer
2
  • ørn, forking the project should be the last resort as the codebases could be diff'd and exploits worked out from them.
    – Huperniketes
    Oct 18, 2010 at 11:47
  • "if noone cares"... I guess we are there.
    – user1249
    Oct 18, 2010 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.