Date: Mon, 14 Nov 2011 17:42:24 -0500 (EST) From: "Steven M. Christey" <coley@...-smtp.mitre.org> To: oss-security@...ts.openwall.com Subject: Re: CVE Request -- Squid v3.1.16 -- Invalid free by processing CNAME DNS record pointing to another CNAME record pointing to an empty A-record In general, an attacker-triggered crash in any type of product that acts as an "intermediary" between two parties - such as a proxy, firewall, mail server, anti-virus, etc. - is typically counted as a vulnerability for CVE, since the crash of the intermediary may cause many active sessions to be lost, not just the session for the attacker. Add repeated crashes and you can have a substantive DoS on your hands. For "passive" intermediaries like IDS and sniffers that just monitor traffic, a crash/DoS can lead to loss of visibility/awareness (passing traffic doesn't get captured), which can allow an attacker to hide activities. - Steve On Mon, 31 Oct 2011, Henrik Nordström wrote: > mÃ¥n 2011-10-31 klockan 14:20 -0600 skrev Kurt Seifried: > >>> Could you allocate a CVE id for this? (cc-ed Henrik and Jiri >>> for their opinion / comments too, if this should be considered >>> a security issue or not) >> >> I'd say so, in the past we have: CVE-2010-2951, CVE-2010-0639, >> CVE-2009-3700, etc. Lots of similar ones. > > Agreed. > > Regards > Henrik > >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.