Re: [tcpm] PoC for draft-moncaster-tcpm-rcv-cheat-02

At 07:29 p.m. 25/03/2008, Stefanos Harhalakis wrote:

>I'm considering wether I should make this (small) tool public or not.
>
>On the plus side: It can be used as a proof of concept and for easily testing
>future implementations of this draft (if it becomes an RFC)
>
>On the minus side: Since it is very easy to use (no kernel patches etc), it
>can be easily abused by people that are not currently able to re-implement
>it.
>
>So, I kindly ask for your advice:
>Based on your experience, would it be of any use if I made this public?

This issue was disclosed by US-CERT. That is, vendors were contacted, 
and had the chance to do something about it.

It has a CVE name: 
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3675 , and 
there's a US-CERT report about it: http://www.kb.cert.org/vuls/id/102014

According to US-CERT's report, there has not been much of a response 
from vendors.

I suggest you contact CERT and let them know that your planning to 
disclose your PoC. Set your own deadline as to until when you'd be 
willing to get a response on a way forward (i.e., are vendors going 
to be as unresponsive as they have been so far?)

Additionally, contact developers at FreeBSD, NetBSD, OpenBSD and 
Linux. I can provide a few names at each, if you want. But they 
usually have some form of security@ contact. I know quite a few 
people at these projects that do care about security issues, and 
would be willing to implement counter-measures if they make sense.

If the process with CERT doesn't go as expected, (and provided you 
have already talked with the open source projects and given them some 
time to do something about it), post your code to bugtraq and CC 
full-disclosure. Also include a pointer to Savage's paper and to 
Sherwood's paper, too. And also include a pointer to Moncaster's draft.

I could also put you in contact with the right people at UK CPNI 
(http://www.cpni.gov.uk). In my own experience, they have proved to 
be more responsive, and much nicer to work with.

Kind regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm