mailing list archives
Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!)
From: cve-assign () mitre org
Date: Wed, 29 Jan 2014 08:50:08 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE-----
Use CVE-2014-1692. The CVE description will indicate that the issue
requires an unusual installation.
As I understand it this can be enabled via code edit/gcc command line
options, so not sure if this qualified for a CVE or not (vuln in code,
yes, is code reachable? not under any default setup, and even on
non-default you have to go pretty far off to enable it).
An impact on the default installation isn't necessary. Vulnerabilities
that occur only after the user modifies code aren't eligible for a
CVE. However, if there's some type of "installation option" mentioned
by the vendor, someone may have chosen that option, and it may be
worthwhile to track the issue with a CVE. The nature of an
"installation option" obviously varies widely across both open-source
and closed-source products.
In this case, there's:
Add support for an experimental zero-knowledge password authentication
method using the J-PAKE protocol ...
This is experimental, work-in-progress code and is presently
compiled-time disabled (turn on -DJPAKE in Makefile.inc).
This is close to the edge of what "installation option" means, but our
feeling is that the vendor wouldn't have provided that #CFLAGS line at
all unless it were expected that an end user might want to make the
CVE assignment team, MITRE CVE Numbering Authority
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
-----END PGP SIGNATURE-----