[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1005251706220.27983@faron.mitre.org>
Date: Tue, 25 May 2010 17:12:07 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Josh Bressers <bressers@...hat.com>
cc: oss-security@...ts.openwall.com, security-2010@...irrelmail.org,
security@...de.org
Subject: Re: CVE Request for Horde and Squirrelmail
While these port-scanning types of issues are rarely reported, there is
precedents for them, especially in the web application security world (see
Jeremiah Grossman's work on port-scanning through web browsers, for a
start).
Even though the consequences may be minimal, they still allow an attacker
from *outside* a network to determine the state of machines that live
*inside* that network, even when the attacker does not have direct access
to the internal netork. So there is an information leak.
As such, the CVE assignment is appropriate. (To the Horde devs, if you
wish to publish a dispute within the CVE description itself, contact me
offline; the description can at least be written to emphasize that it only
happens when sysadmins don't follow documentation.)
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
