[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20150514175356.6DF79B2E201@smtpvbsrv1.mitre.org>
Date: Thu, 14 May 2015 13:53:56 -0400 (EDT)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, stenn@....org
Subject: Re: Potential issue in NTP -A option
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> the documentation seems to conflict slightly
We do not feel that a CVE is required; however, Harlan can choose to
have a CVE ID if the undocumented risky behavior is going to be
announced as a vulnerability.
More specifically, it appears that mode 7 itself is, in some sense,
deprecated (e.g., "mode7 ... Enables processing of NTP mode 7
implementation-specific requests which are used by the deprecated
ntpdc program" on the
http://www.eecis.udel.edu/~mills/ntp/html/miscopt.html page and
"functionally deprecating ntpdc" on the
http://support.ntp.org/bin/view/Main/SoftwareDownloads page). If so,
then we do not feel that there is a requirement for the documentation
to precisely specify the effect of a command-line option on a
deprecated feature. The -A documentation doesn't directly make a false
statement about authentication within mode 7; it simply does not
discuss mode 7.
If mode 7 itself isn't deprecated, and there is a supported use case
in which the user may choose to enable both mode 7 and the -A option,
then announcing the behavior/documentation mismatch as a vulnerability
is probably more useful.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVVOBzAAoJEKllVAevmvmsy4oH/REWyDXtOBOoJL5lYtj6zroV
DATBhEgJTGSK7m7zc5Z1sqGGEGXNthghS8VGysc4T1vbkgKVO0hpATMzHdZb6L6R
rNGggnTpHxoubpKRt+flURxCBzMta0w9brQb2vXxUvh4RYy+6MklDqGQofQA3ELB
9rZW6wkMK3KYms00HJGrGkIutxcVe+1/1At6htLGlQo3wEuY5ORHdlxmUxHaXBos
99fyRa1rR8ZzrN1EKWgh62WUhetvauqASFlYXdhNcqUgySlzIfMrAlFpLUyvTIGn
TjTYgf+XAvlQLmnPjKV48IeY/g2BE8MHO61loTCX5fBeYMT3lzyl2PVDx6sIN9s=
=MpGY
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
