Re: INTERIM DECISION: ACCEPT 5 SA category candidates (Final 9/28)

• To: cve-editorial-board-list@lists.mitre.org
• Subject: Re: INTERIM DECISION: ACCEPT 5 SA category candidates (Final 9/28)
• From: "Steven M. Christey" <coley@linus.mitre.org>
• Date: Tue, 28 Sep 1999 12:00:27 -0400 (EDT)
• Delivery-Date: Tue Sep 28 12:03:15 1999
• Sender: owner-cve-editorial-board-list@lists.mitre.org

>Note that the entry says "the finger service is running" .  It does
>not say that the original, unmodified service is running.

How about this:

"A version of finger is running that releases valid user information
to any entity on the network."

This avoids TCP-wrappered finger and the basic modifications that Spaf
was talking about.  I'd prefer not to have a description identify all
the types of scenarios where it might not be an exposure, as I've
tried to keep descriptions as short as possible.  On the other hand,
dot notation may be useful for identifying the various flavors of
finger within this single entry.

- Steve

• Follow-Ups:
  • Re: INTERIM DECISION: ACCEPT 5 SA category candidates (Final 9/28)
    • From: Gene Spafford <spaf@cs.purdue.edu>

• Prev by Date: Re: Mapping Comparison - Counting Differences
• Next by Date: Re: Mapping Comparison - Counting Differences
• Prev by thread: Re: INTERIM DECISION: ACCEPT 5 SA category candidates (Final 9/28)
• Next by thread: Re: INTERIM DECISION: ACCEPT 5 SA category candidates (Final 9/28)
• Index(es):
  • Date
  • Thread