[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Mar 2011 10:47:37 +0000
From: David Woodhouse <dwmw2@...radead.org>
To: Josh Bressers <bressers@...hat.com>
Cc: oss-security@...ts.openwall.com, David King <amigadave@...gadave.com>,
Mark McLoughlin <mark@...net.ie>, "Steven M. Christey"
<coley@...us.mitre.org>
Subject: Re: CVE Request / Discussion -- vino -- reports the
desktop being reachable only over the local network, when reachable from
everywhere
On Tue, 2011-03-15 at 17:10 -0400, Josh Bressers wrote:
>
> Issue #2
>
> Vino can open ports via uPnP without alerting the user.
> https://bugzilla.redhat.com/show_bug.cgi?id=678846
>
> Use CVE-2011-1165
I strongly disagree that this is CVE-worthy, or even a bug.
That's what uPnP is *for*.
Opening a port with uPnP, in a NAT-afflicted situation, is identical to
binding to and listening on INADDR_ANY when you have real network
connectivity. It's the moral equivalent to automatically using SOCKS to
make outbound connections, if you're afflicted with a network that needs
that.
There *is* an option to disable this feature, if the user really wants
to. And of course it should be clearly indicated that the service is
available to the public; but *that* is what CVE-2011-1164 is for.
There is also some merit in arguing that connections from outside the
local network should not be permitted without a password. But again,
there's nothing specific to uPnP in that.
--
David Woodhouse Open Source Technology Centre
David.Woodhouse@...el.com Intel Corporation
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
