Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Mar 2011 10:47:37 +0000
From: David Woodhouse <>
To: Josh Bressers <>
Cc:, David King <>, 
 Mark McLoughlin <>, "Steven M. Christey"
Subject: Re: CVE Request / Discussion -- vino -- reports the
 desktop being reachable only over the local network, when reachable from

On Tue, 2011-03-15 at 17:10 -0400, Josh Bressers wrote:
> Issue #2
> Vino can open ports via uPnP without alerting the user.
> Use CVE-2011-1165 

I strongly disagree that this is CVE-worthy, or even a bug.

That's what uPnP is *for*.

Opening a port with uPnP, in a NAT-afflicted situation, is identical to
binding to and listening on INADDR_ANY when you have real network
connectivity. It's the moral equivalent to automatically using SOCKS to
make outbound connections, if you're afflicted with a network that needs

There *is* an option to disable this feature, if the user really wants
to. And of course it should be clearly indicated that the service is
available to the public; but *that* is what CVE-2011-1164 is for.

There is also some merit in arguing that connections from outside the
local network should not be permitted without a password. But again,
there's nothing specific to uPnP in that.

David Woodhouse                            Open Source Technology Centre                              Intel Corporation

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.