[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CANO=Ty0BX4m57asPzCzr2mcKP96VjYc2j12FxwrOy28ggbapGg@mail.gmail.com>
Date: Mon, 8 May 2017 11:34:18 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Re: remote DoS via CPU exhaustion in anon FTP
server glob expansion
Just a note on how CVE works: CVE is for specific vulnerabilities. E.g. If
you find a specific XSS in a product for example, or a globbing problem in
an FTP server that allows someone to crash it by ls */*/*....*/*/*.
Alternatively there can be CVE's for protocol level flaws (e.g. where the
specification itself was flawed), or for security technologies that aren't
secure anymore (e.g. DES, 56bit keyspace just isn't big enough anymore with
a modern laptop, let alone access to cloud GPU systems) to name a few more
general cases.
Also for DoS type attacks it can be a gray area, e.g. "send a ping of
death, system crashes" is clearly a problem, but "open X Million
connections and system gets slow" is... well... normal behavior for most
things. In the case of globbing where do we go from "it simply takes a long
time for a complicated request" to "this is pathological behavior and needs
to be fixed" (it takes 1 second? 100 seconds? 100 minutes?).
In any event if there are specific instances of a given FTP server (or
whatever) that can be crashed/made really non responsive by this class of
attack then that is appropriate to ask for a CVE and would be given one.
On Mon, May 8, 2017 at 7:10 AM, Russ Cox <rsc@...ch.com> wrote:
> On Mon, Apr 24, 2017 at 10:06 AM, Russ Cox <rsc@...ch.com> wrote:
> > > Due to the widespread but limited ("only" CPU exhaustion) nature of
> > the problem, I have not attempted any embargoed prenotification.
> > I will forward this note directly to product-security@...le.com and
> > bugs@...eftpd.org. I filled out the "DWF Open Source Request Form v2"
> > for a CVE number for the generic problem, and I will reply here when
> > I receive the number.
>
> FYI, over the weekend I received notification (two weeks after applying)
> that DWF has declined to issue a CVE number for this general problem.
> Interested parties will have to obtain their own CVE numbers for specific
> products.
>
> Russ
>
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
