Date: Fri, 28 Sep 2012 13:16:42 -0400 (EDT) From: cve-assign@...re.org To: Roman.Fiedler@....ac.at Cc: oss-security@...ts.openwall.com, cve-assign@...re.org Subject: Re: RFC: ntp behavior with spoofed source IPs -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Although we suspect this message isn't primarily about CVE assignments, here are two comments: >While changing from openntpd (Ubuntu/universe) to ntp (main), a short >evaluation of ntp configuration options was performed. >Newer versions come with a default configuration listening on all >interfaces ... The general issue of interface listening in an NTP daemon's configuration is perhaps best covered by CCE. CCE-4134-3 (in the http://cce.mitre.org/lists/data/downloads/cce-rhel5-5.20111007.xls document) is one related identifier. >The configuration uses "restrict" statements to restrict querying and >modification to LAN side only. >Following scenarios come to my mind with the interfaces default >configuration Do all of these scenarios require a host and network configuration that accepts packets with LAN source IP addresses even if these packets arrive from the Internet interface? Typically it's not the responsibility of an individual network application program to address those scenarios. If an application program tried to address such a scenario but had an implementation error (e.g., it documented 192.168.0.0/16 as a hardcoded safe network but actually had 188.8.131.52/16 hardcoded), that's a different situation and a CVE could be assigned. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (SunOS) iQEcBAEBAgAGBQJQZdorAAoJEGvefgSNfHMdfdQIALepH5LougEZFT0tdJuFHM+7 VHB3PlbqlpeLT593lHcad7Sgr6kbwR3RjVmqrmS3+vqRataNZNDOwogb57fwAqaI Ks2gV/5orRsb2wN7gAvmYqhhE5MFUgxm3ygHSft932kds+2u6qodwQMOt2wkAy5z eQlRjwbO99OC2Atfc5yWkLcoJtQo4vfPlRgdhUfpIZlPX2wt7X0GpK2IOHsJyVjo 2U8t8t7KFjj4i99ocaIOh6bNKusp5tAobSRjx0tsRwCZ6G4LO0tyq3LlbyXxtA2r 0QVQrK0mX2+Ho8n7FaeWPbwM7VzyyXLf9Je0gCwpn9X0q1OiB7vsA3R01FIGOYg= =kVUT -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.