Date: Wed, 16 Mar 2011 10:47:37 +0000 From: David Woodhouse <dwmw2@...radead.org> To: Josh Bressers <bressers@...hat.com> Cc: oss-security@...ts.openwall.com, David King <amigadave@...gadave.com>, Mark McLoughlin <mark@...net.ie>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable from everywhere On Tue, 2011-03-15 at 17:10 -0400, Josh Bressers wrote: > > Issue #2 > > Vino can open ports via uPnP without alerting the user. > https://bugzilla.redhat.com/show_bug.cgi?id=678846 > > Use CVE-2011-1165 I strongly disagree that this is CVE-worthy, or even a bug. That's what uPnP is *for*. Opening a port with uPnP, in a NAT-afflicted situation, is identical to binding to and listening on INADDR_ANY when you have real network connectivity. It's the moral equivalent to automatically using SOCKS to make outbound connections, if you're afflicted with a network that needs that. There *is* an option to disable this feature, if the user really wants to. And of course it should be clearly indicated that the service is available to the public; but *that* is what CVE-2011-1164 is for. There is also some merit in arguing that connections from outside the local network should not be permitted without a password. But again, there's nothing specific to uPnP in that. -- David Woodhouse Open Source Technology Centre David.Woodhouse@...el.com Intel Corporation
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.