oss-sec mailing list archives
Re: RFC: ntp behavior with spoofed source IPs
From: cve-assign () mitre org
Date: Fri, 28 Sep 2012 13:16:42 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Although we suspect this message isn't primarily about CVE assignments, here are two comments:
While changing from openntpd (Ubuntu/universe) to ntp (main), a short evaluation of ntp configuration options was performed.
Newer versions come with a default configuration listening on all interfaces ...
The general issue of interface listening in an NTP daemon's configuration is perhaps best covered by CCE. CCE-4134-3 (in the http://cce.mitre.org/lists/data/downloads/cce-rhel5-5.20111007.xls document) is one related identifier.
The configuration uses "restrict" statements to restrict querying and modification to LAN side only.
Following scenarios come to my mind with the interfaces default configuration
Do all of these scenarios require a host and network configuration that accepts packets with LAN source IP addresses even if these packets arrive from the Internet interface? Typically it's not the responsibility of an individual network application program to address those scenarios. If an application program tried to address such a scenario but had an implementation error (e.g., it documented 192.168.0.0/16 as a hardcoded safe network but actually had 192.186.0.0/16 hardcoded), that's a different situation and a CVE could be assigned. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (SunOS) iQEcBAEBAgAGBQJQZdorAAoJEGvefgSNfHMdfdQIALepH5LougEZFT0tdJuFHM+7 VHB3PlbqlpeLT593lHcad7Sgr6kbwR3RjVmqrmS3+vqRataNZNDOwogb57fwAqaI Ks2gV/5orRsb2wN7gAvmYqhhE5MFUgxm3ygHSft932kds+2u6qodwQMOt2wkAy5z eQlRjwbO99OC2Atfc5yWkLcoJtQo4vfPlRgdhUfpIZlPX2wt7X0GpK2IOHsJyVjo 2U8t8t7KFjj4i99ocaIOh6bNKusp5tAobSRjx0tsRwCZ6G4LO0tyq3LlbyXxtA2r 0QVQrK0mX2+Ho8n7FaeWPbwM7VzyyXLf9Je0gCwpn9X0q1OiB7vsA3R01FIGOYg= =kVUT -----END PGP SIGNATURE-----
Current thread:
- RFC: ntp behavior with spoofed source IPs Fiedler Roman (Sep 26)
- Re: RFC: ntp behavior with spoofed source IPs Mike O'Connor (Sep 27)
- Re: RFC: ntp behavior with spoofed source IPs cve-assign (Sep 28)