Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171498

Re: Any idea when CVE-2016-5696 is going to get fixed?

Show all headers | View raw

On Sun, 28 Aug 2016 14:35:01 +0200
Frederic Marchal <frederic.marchal@wowtechnology.com> wrote:

> The attack is also useless if the attacker can't spoof the source IP 
> address. Routers in corporate environments usually block this by design or 
> due to VLAN. For that reason, the attack can't come from the same LAN to 
> bypass the border firewall. This rules out an unhappy coworker, infected 
> computer or a student with too much time on his hands.

This is the first and foremost requirement. If the packets' source address cannot be spoofed, the attack cannot be attempted.

I'm less concerned with how many sites/protocols are vulnerable than I am with how many ISPs allow spoofed packets out of their networks. It should be trivial for any ISP to drop packets that, given the source address, could not have originated within its network.

In fact, I'd go so far as to say that no ISP should be allowed to connect to the internet unless solid anti-spoofing measures are in place.

The CVE may be primarily of academic interest, but it is still a vulnerability that must be addressed. And the Debian crew will address it soon enough.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 17:10 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 17:20 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-26 18:40 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 19:50 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-26 21:10 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-27 05:20 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "John T. Haggerty" <jpcookie@gmail.com> - 2016-08-27 05:30 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2016-08-27 17:50 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-28 14:40 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-28 21:40 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-28 23:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Tixy <tixy@yxit.co.uk> - 2016-08-29 13:00 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Gene Heskett <gheskett@shentel.net> - 2016-08-29 18:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-29 19:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 20:30 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-29 23:50 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 00:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Charlie <ariestao1@ipstarmail.com.au> - 2016-08-30 06:50 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 03:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-29 05:50 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 07:10 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Salvatore Bonaccorso <carnil@debian.org> - 2016-08-29 07:30 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200

csiph-web