Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171467

Re: Any idea when CVE-2016-5696 is going to get fixed?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Friday 26 August 2016 11:04:04 Perry E. Metzger wrote:
> According to:
> 
> https://security-tracker.debian.org/tracker/CVE-2016-5696
> 
> Wheezy and Jessie are still vulnerable. The attack in question is
> kind of bad (it allows blind injection of arbitrary data into
> things like http downloads) and has been known for a few weeks now to
> the general public.

I don't think the issue is that bad.

It allows an attacker to find out if you are connected to a particular web 
site and makes it easier to interrupt the transfer by sending a RST or SYN 
packet or inject junk data to corrupt the flow. It's simple denial of service.

But to achieve that, you must be downloading something from a web site 
the attacker is actually targeting. The attacker must know you are doing 
so or find out by sheer luck. The download must be long enough (more 
than one minute) for the attacker to discover the set of parameters that 
will make the attack successful. That's unlikely to succeed on a massive 
scale if you ask me!

Beside, the attacker can't possibly know what you are downloading and 
how much data has already been downloaded. There is no way he can 
inject anything useful into the downloaded data. You would end up with a 
corrupted file in the worst case. A worm can't propagate that way.

Frederic

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 17:10 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 17:20 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-26 18:40 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 19:50 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-26 21:10 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-27 05:20 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "John T. Haggerty" <jpcookie@gmail.com> - 2016-08-27 05:30 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2016-08-27 17:50 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-28 14:40 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-28 21:40 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-28 23:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Tixy <tixy@yxit.co.uk> - 2016-08-29 13:00 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Gene Heskett <gheskett@shentel.net> - 2016-08-29 18:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-29 19:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 20:30 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-29 23:50 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 00:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Charlie <ariestao1@ipstarmail.com.au> - 2016-08-30 06:50 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 03:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-29 05:50 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 07:10 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Salvatore Bonaccorso <carnil@debian.org> - 2016-08-29 07:30 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200

csiph-web