Volunteering for OSVDB

By Susam Pal on 24 Jun 2006

I am now an active Open Source Vulnerability Database (OSVDB) volunteer. I joined it on 06 Jun 2006. Although I enrolled as a volunteer there around 3 weeks, I worked on a vulnerability for the first time today. The vulnerability I picked for my first contribution was 0verkill recv_packet() Function UDP Handling Overflow DoS. This is an integer underflow error in a Linux based gaming daemon called 0verkill. It could be exploited to launch DoS attacks by sending UDP packets of size less than 12 bytes to the 0verkill daemon. An example exploit code is available at this Bugtraq thread.

OSVDB is a project of the Open Security Foundation. Its goal is to provide accurate, unbiased information about security vulnerabilities in computerized equipment. The core of OSVDB is a relational database which ties various information about security vulnerabilities into a common, cross-referenced data source.

In OSVDB, vulnerability reports, advisories, and exploits posted in various security lists enter the database as new entries. Each new entry contains only a title and links to entries of the same vulnerability in other security lists. However, a new entry does not contain any detailed description of the vulnerability. After the new entries are thoroughly scrutinized, analyzed, and refined by us, we add vulnerability description, technical description, solution description, manual testing notes, etc. Then these details on each entry are reviewed by other members of OSVDB, further refined if necessary, and then marked as stable entries. Once an entry for a vulnerability becomes stable, the detailed information for it appears on the page for the entry. One of the wonderful things that OSVDB brings to the world of security research is that each entry published on the OSVDB website has an extensive and almost exhaustive list of cross-references linking together all information about the vulnerability available on various security databases.