How to widely advertise a fixed important threat in widely used open source software?

Question

6 months ago, I found a buffer overflow in git which has the same impact as this vulnerability (with the execption that it allow server side code execution). It got several cve assigned to it and was completely fixed upstream.

However, 2 months after the upstream fix, the cve details are still unpublished and near no Linux distribution updated their stable branch.
I even noticed that wikimedia gerrit and bitbucket.org were still vulnerable last week (I warned the appropriates persons and it got fixed on wikimedia).

I definitely can’t bring the information to every provider. I know it can take years for a cve to be published. But It definitely don’t break the news like cve-2014-9390.

How to widely advertise it so peoples and Linux distributions fix their machines ?

Answer 1

Unfortunately there are no hard and fast rules about this kind of issue and with the very wide use of open source components and libraries it's inevitable that some companies won't update even after a long time (for example 200k servers still vulnerable to Heartbleed a year after release)

In terms of getting people to pay attention and patch, unfortunately it still seems like the only way is to publish vulnerability information widely and publicly, after an appropriate private notification period.

Exactly how long you want to have for that period is a matter of debate, with people going from 0-days all the way up to many months.

Perhaps a decent guideline would be to follow Cert's Responsible Disclosure Policy which releases after 45 days.

From the timeline you describe it sounds like you're well past that point already, so really if you want to see more people pay attention the best way may be to write up a blog post describing the issue and potential impact and circulate it widely.

Whilst it may seem cynical to suggest this, in terms of getting people to pay attention, marketing the vulnerability may be the best way to go. If you look at recent vuln's that get publicity most have a catchy name ("Drown", "Heartbleed" etc) and the write-ups explain in quite clear terms the likely impact. Then it's a case of it getting picked up in social media (twitter, reddit etc) and starting circulation amongst the InfoSec community.

Answer 2

It's an obvious fairytale about the CVE, CERT and so forth "vulnerability assessment teams/agencies". And if such a questions are keeping rising, I feel I must break your illusions into a very small and sharp glasspieces....

Remember: there's NO such things, as a collective vulnerability assessment teams/agencies like CVE, etc. Why? Too many government agencies are in vital need of the backdoor-like vulnerabilities to be in existance, to make them able to break in illegally and stealthy. Remember alot of stories like BlackHat speech cancellations, lawsuit against a person who found a backdoor in ALL Cisco, Edward Snowden just followed the supreme law of his country - the USA Constitution - and he is now on "most wanted" list. And these are the most loudly-spoken things, there are lots more - I've just not mentioning them here, but I can add some info if requested.

Even being caught - government agencies are enforcing and covering their crime-mates, like The Hacked Team. Yes, their malware was opened and opensourced by a leak. Also a Bundestrojan(er) was detected and showed to public... How many antiviruses are catching precisely that malware nowdays? even taking in account a time lag between the moment they were actually found and brought down to the public

Wake up! The only way to show that something is wrong is to say about it as louder as you can to as broader audience as you can reach. With all proves, code examples e.t.c. Only then it won't be silently disclosed and some actual steps will be in order by Vox populi. It's the only way nowdays, and that's the thing governments are fighting with - so be prepared, if you dare ;)