[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201209281716.q8SHGgCn025780@linus.mitre.org>
Date: Fri, 28 Sep 2012 13:16:42 -0400 (EDT)
From: cve-assign@...re.org
To: Roman.Fiedler@....ac.at
Cc: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: Re: RFC: ntp behavior with spoofed source IPs
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Although we suspect this message isn't primarily about CVE assignments,
here are two comments:
>While changing from openntpd (Ubuntu/universe) to ntp (main), a short
>evaluation of ntp configuration options was performed.
>Newer versions come with a default configuration listening on all
>interfaces ...
The general issue of interface listening in an NTP daemon's
configuration is perhaps best covered by CCE. CCE-4134-3 (in the
http://cce.mitre.org/lists/data/downloads/cce-rhel5-5.20111007.xls
document) is one related identifier.
>The configuration uses "restrict" statements to restrict querying and
>modification to LAN side only.
>Following scenarios come to my mind with the interfaces default
>configuration
Do all of these scenarios require a host and network configuration
that accepts packets with LAN source IP addresses even if these
packets arrive from the Internet interface? Typically it's not the
responsibility of an individual network application program to address
those scenarios. If an application program tried to address such a
scenario but had an implementation error (e.g., it documented
192.168.0.0/16 as a hardcoded safe network but actually had
192.186.0.0/16 hardcoded), that's a different situation and a CVE
could be assigned.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (SunOS)
iQEcBAEBAgAGBQJQZdorAAoJEGvefgSNfHMdfdQIALepH5LougEZFT0tdJuFHM+7
VHB3PlbqlpeLT593lHcad7Sgr6kbwR3RjVmqrmS3+vqRataNZNDOwogb57fwAqaI
Ks2gV/5orRsb2wN7gAvmYqhhE5MFUgxm3ygHSft932kds+2u6qodwQMOt2wkAy5z
eQlRjwbO99OC2Atfc5yWkLcoJtQo4vfPlRgdhUfpIZlPX2wt7X0GpK2IOHsJyVjo
2U8t8t7KFjj4i99ocaIOh6bNKusp5tAobSRjx0tsRwCZ6G4LO0tyq3LlbyXxtA2r
0QVQrK0mX2+Ho8n7FaeWPbwM7VzyyXLf9Je0gCwpn9X0q1OiB7vsA3R01FIGOYg=
=kVUT
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
