Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 25 May 2010 17:12:07 -0400 (EDT)
From: "Steven M. Christey" <>
To: Josh Bressers <>
Subject: Re: CVE Request for Horde and Squirrelmail

While these port-scanning types of issues are rarely reported, there is 
precedents for them, especially in the web application security world (see 
Jeremiah Grossman's work on port-scanning through web browsers, for a 

Even though the consequences may be minimal, they still allow an attacker 
from *outside* a network to determine the state of machines that live 
*inside* that network, even when the attacker does not have direct access 
to the internal netork.  So there is an information leak.

As such, the CVE assignment is appropriate.  (To the Horde devs, if you 
wish to publish a dispute within the CVE description itself, contact me 
offline; the description can at least be written to emphasize that it only 
happens when sysadmins don't follow documentation.)

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.