Date: Tue, 25 May 2010 17:12:07 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: Josh Bressers <bressers@...hat.com> cc: oss-security@...ts.openwall.com, security-2010@...irrelmail.org, security@...de.org Subject: Re: CVE Request for Horde and Squirrelmail While these port-scanning types of issues are rarely reported, there is precedents for them, especially in the web application security world (see Jeremiah Grossman's work on port-scanning through web browsers, for a start). Even though the consequences may be minimal, they still allow an attacker from *outside* a network to determine the state of machines that live *inside* that network, even when the attacker does not have direct access to the internal netork. So there is an information leak. As such, the CVE assignment is appropriate. (To the Horde devs, if you wish to publish a dispute within the CVE description itself, contact me offline; the description can at least be written to emphasize that it only happens when sysadmins don't follow documentation.) - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.