<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello,<br>We are involved in a software security research project called ReDebug<br>out of Carnegie Mellon University. We believe we have found vulnerable<br>code in a project you maintain related to CVE-2008-3230, CVE-2008-4610, CVE-2008-4866. <div>This email and the attachment describes the vulnerability. We apologize for the<br>form-letterness of this email; we found over 11,000 such<br>vulnerabilities in our research project, and are trying to get the<br>word out to all developers. What we hope to get from you is a<br>confirmation whether the identified problem is real for a paper we are<br>writing.<br><br>The goal of ReDebug is to find unpatched code clones at OS<br>distribution-sized code bases. An unpatched code clone occurs when<br>code is copied from a project, but later patches to that project are<br>not propagated to the copies. As part of this research, we downloaded<br>over 1.7 billion lines of code, including all source code from Debian,<br>Ubuntu, and all C code from SourceForge. ReDebug identified 11,287<br>unpatched code clones for patches associated with Debian security<br>advisories in about 6 hours on a MacBook Pro Laptop.<br><br>Our attached file is a snapshot from our database that first shows the<br>patch to the original package, and then shows unpatched code clones in<br>the package we think you may maintain. The unpatched code has been<br>patched in other packages per a Debian security advisory.<br><br>The attached web page shows:<br>- A patch, with the appropriate CVE number or other identifier as<br>part of the file name. You can google the CVE to find more<br>information, or consult the Debian security archive for the patch.<br>- A list of code snippets showing the identified unpatched code.<br><br>We understand you are very busy, but it would very much help our<br>research if you could reply with confirmation on whether the<br>identified problem(s) are really bugs.<br><br>Take care,<br>- Jiyong Jang, Abeer Agrawal, and David Brumley<br><a href="http://security.ece.cmu.edu">http://security.ece.cmu.edu</a></div><div><br></div><div></div></body></html>