[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <661055294.29341.1300276718876.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 16 Mar 2011 07:58:38 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: David Woodhouse <dwmw2@...radead.org>
Cc: oss-security@...ts.openwall.com, Mark McLoughlin <mark@...net.ie>,
"Steven M. Christey" <coley@...us.mitre.org>,
David King <amigadave@...gadave.com>
Subject: Re: CVE Request / Discussion -- vino -- reports the
desktop being reachable only over the local network, when reachable from
everywhere
----- Original Message -----
> On Wed, 2011-03-16 at 12:02 +0100, David King wrote:
> > It should be noted that the UPnP feature is disabled by default, so the
> > user has the option to *enable* it. I concede that the string presented
> > in the UI needs improvement.
>
> That isn't CVE-worthy, though, surely?
>
> > Of course, I agree that indication of the consequences would be
> > appropriate,
>
> That's CVE-2011-1164.
>
> > and also disallowing the 'none' authentication method if UPnP is
> > enabled.
>
> And that, again, is not at all specific to UPnP.
>
> Disallowing the 'none' authentication method is would be appropriate
> whenever the machine is accessible from the outside world, whether that's
> through UPnP or just by listening on a publicly-available IP address.
>
I probably should have been more clear here. I was under the impression the
CVE id applied to instances where it would use UPnP and no auth, which is
dangerous and should probably include a big warning with a button that says
"I know what I'm doing (but probably not really)".
UPnP by itself is not a security flaw.
Sorry for the confusion.
--
JB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
