Date: Thu, 14 May 2015 13:53:56 -0400 (EDT) From: cve-assign@...re.org To: kseifried@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, stenn@....org Subject: Re: Potential issue in NTP -A option -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > the documentation seems to conflict slightly We do not feel that a CVE is required; however, Harlan can choose to have a CVE ID if the undocumented risky behavior is going to be announced as a vulnerability. More specifically, it appears that mode 7 itself is, in some sense, deprecated (e.g., "mode7 ... Enables processing of NTP mode 7 implementation-specific requests which are used by the deprecated ntpdc program" on the http://www.eecis.udel.edu/~mills/ntp/html/miscopt.html page and "functionally deprecating ntpdc" on the http://support.ntp.org/bin/view/Main/SoftwareDownloads page). If so, then we do not feel that there is a requirement for the documentation to precisely specify the effect of a command-line option on a deprecated feature. The -A documentation doesn't directly make a false statement about authentication within mode 7; it simply does not discuss mode 7. If mode 7 itself isn't deprecated, and there is a supported use case in which the user may choose to enable both mode 7 and the -A option, then announcing the behavior/documentation mismatch as a vulnerability is probably more useful. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVVOBzAAoJEKllVAevmvmsy4oH/REWyDXtOBOoJL5lYtj6zroV DATBhEgJTGSK7m7zc5Z1sqGGEGXNthghS8VGysc4T1vbkgKVO0hpATMzHdZb6L6R rNGggnTpHxoubpKRt+flURxCBzMta0w9brQb2vXxUvh4RYy+6MklDqGQofQA3ELB 9rZW6wkMK3KYms00HJGrGkIutxcVe+1/1At6htLGlQo3wEuY5ORHdlxmUxHaXBos 99fyRa1rR8ZzrN1EKWgh62WUhetvauqASFlYXdhNcqUgySlzIfMrAlFpLUyvTIGn TjTYgf+XAvlQLmnPjKV48IeY/g2BE8MHO61loTCX5fBeYMT3lzyl2PVDx6sIN9s= =MpGY -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.