Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable from everywhere

[Josh Bressers <bressers () redhat com>]

----- Original Message -----
> On Wed, 2011-03-16 at 12:02 +0100, David King wrote:
> > It should be noted that the UPnP feature is disabled by default, so the
> > user has the option to *enable* it. I concede that the string presented
> > in the UI needs improvement.
>
> That isn't CVE-worthy, though, surely?
>
> > Of course, I agree that indication of the consequences would be
> > appropriate,
>
> That's CVE-2011-1164.
>
> > and also disallowing the 'none' authentication method if UPnP is
> > enabled.
>
> And that, again, is not at all specific to UPnP.
>
> Disallowing the 'none' authentication method is would be appropriate
> whenever the machine is accessible from the outside world, whether that's
> through UPnP or just by listening on a publicly-available IP address.

I probably should have been more clear here. I was under the impression the
CVE id applied to instances where it would use UPnP and no auth, which is
dangerous and should probably include a big warning with a button that says
"I know what I'm doing (but probably not really)".

UPnP by itself is not a security flaw.

Sorry for the confusion.

-- 
    JB