Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171500

Re: Any idea when CVE-2016-5696 is going to get fixed?

From Mark Fletcher <mark27q1@gmail.com>
Newsgroups linux.debian.user
Subject Re: Any idea when CVE-2016-5696 is going to get fixed?
Date 2016-08-29 05:50 +0200
Message-ID <sblKa-26h-9@gated-at.bofh.it> (permalink)
References <saqVz-ki-3@gated-at.bofh.it> <sauFQ-2Ek-7@gated-at.bofh.it> <saCk2-7AH-9@gated-at.bofh.it> <sb7xw-1GT-27@gated-at.bofh.it> <sbjyF-M1-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, 29 Aug 2016 at 10:21, Neal P. Murphy <neal.p.murphy@alum.wpi.edu>
wrote:

> On Sun, 28 Aug 2016 14:35:01 +0200
> Frederic Marchal <frederic.marchal@wowtechnology.com> wrote:
>
> > The attack is also useless if the attacker can't spoof the source IP
> > address. Routers in corporate environments usually block this by design
> or
> > due to VLAN. For that reason, the attack can't come from the same LAN to
> > bypass the border firewall. This rules out an unhappy coworker, infected
> > computer or a student with too much time on his hands.
>
> This is the first and foremost requirement. If the packets' source address
> cannot be spoofed, the attack cannot be attempted.
>
> I'm less concerned with how many sites/protocols are vulnerable than I am
> with how many ISPs allow spoofed packets out of their networks. It should
> be trivial for any ISP to drop packets that, given the source address,
> could not have originated within its network.
>
> In fact, I'd go so far as to say that no ISP should be allowed to connect
> to the internet unless solid anti-spoofing measures are in place.
>
> The CVE may be primarily of academic interest, but it is still a
> vulnerability that must be addressed. And the Debian crew will address it
> soon enough.
>
> Version 4.7 of the kernel contains a fix, which only required changes to
one source file, so I assume it's a question of back porting that fix into
the Jessie version of the kernel. I might take a look at trying that and
submit a patch if I can get it to work. (Now watch me trip over a dozen
issues I didn't think of when I try this)

Mark

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 17:10 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 17:20 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-26 18:40 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 19:50 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-26 21:10 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-27 05:20 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "John T. Haggerty" <jpcookie@gmail.com> - 2016-08-27 05:30 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2016-08-27 17:50 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-28 14:40 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-28 21:40 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-28 23:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Tixy <tixy@yxit.co.uk> - 2016-08-29 13:00 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Gene Heskett <gheskett@shentel.net> - 2016-08-29 18:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-29 19:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 20:30 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-29 23:50 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 00:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Charlie <ariestao1@ipstarmail.com.au> - 2016-08-30 06:50 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 03:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-29 05:50 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 07:10 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Salvatore Bonaccorso <carnil@debian.org> - 2016-08-29 07:30 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200

csiph-web