Date: Mon, 8 May 2017 11:34:18 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: Re: remote DoS via CPU exhaustion in anon FTP server glob expansion Just a note on how CVE works: CVE is for specific vulnerabilities. E.g. If you find a specific XSS in a product for example, or a globbing problem in an FTP server that allows someone to crash it by ls */*/*....*/*/*. Alternatively there can be CVE's for protocol level flaws (e.g. where the specification itself was flawed), or for security technologies that aren't secure anymore (e.g. DES, 56bit keyspace just isn't big enough anymore with a modern laptop, let alone access to cloud GPU systems) to name a few more general cases. Also for DoS type attacks it can be a gray area, e.g. "send a ping of death, system crashes" is clearly a problem, but "open X Million connections and system gets slow" is... well... normal behavior for most things. In the case of globbing where do we go from "it simply takes a long time for a complicated request" to "this is pathological behavior and needs to be fixed" (it takes 1 second? 100 seconds? 100 minutes?). In any event if there are specific instances of a given FTP server (or whatever) that can be crashed/made really non responsive by this class of attack then that is appropriate to ask for a CVE and would be given one. On Mon, May 8, 2017 at 7:10 AM, Russ Cox <rsc@...ch.com> wrote: > On Mon, Apr 24, 2017 at 10:06 AM, Russ Cox <rsc@...ch.com> wrote: > > > Due to the widespread but limited ("only" CPU exhaustion) nature of > > the problem, I have not attempted any embargoed prenotification. > > I will forward this note directly to product-security@...le.com and > > bugs@...eftpd.org. I filled out the "DWF Open Source Request Form v2" > > for a CVE number for the generic problem, and I will reply here when > > I receive the number. > > FYI, over the weekend I received notification (two weeks after applying) > that DWF has declined to issue a CVE number for this general problem. > Interested parties will have to obtain their own CVE numbers for specific > products. > > Russ > -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.