Re: Bastille and Comcast CVE IDs

• To: Kurt Seifried <kseifried@redhat.com>
• Subject: Re: Bastille and Comcast CVE IDs
• From: Art Manion <amanion@cert.org>
• Date: Sun, 1 Oct 2017 13:07:30 -0400
• Authentication-results: spf=none (sender IP is 129.83.29.2) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=cert.org;
• Cc: "cve-editorial-board-list@lists.mitre.org" <cve-editorial-board-list@lists.mitre.org>
• Delivery-date: Mon Oct 2 07:45:40 2017
• Dkim-filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu v91H7Ye3007398
• In-reply-to: <CANO=Ty3x3Dd-3_D5-_TU=ccoLsSXxZFgQKqXYQvW+Gq-dY3Fdw@mail.gmail.com>
• List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
• List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
• List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
• List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
• References: <99f4aac1-f1d7-1a4e-a821-cc40b1ba4687@cert.org> <CANO=Ty3x3Dd-3_D5-_TU=ccoLsSXxZFgQKqXYQvW+Gq-dY3Fdw@mail.gmail.com>
• Sender: <owner-cve-editorial-board-list@lists.mitre.org>
• Spamdiagnosticmetadata: 5952c28dcc454f0789fb433d26f936ef
• Spamdiagnosticoutput: 1:2
• User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.3.0

On 2017-09-29 23:03, Kurt Seifried wrote:

> CVE-2017-9480 is one possible impact (attacker can download config
> file) of CVE-2017-9479 (syseventd running as root listening on some
> local networks).

> If I could plug a cable into your phone and control it with no
> further passwords/etc, that'd be a CVE right?
Avoiding the physical access discussion for the moment (or accepting 
your position), why are these two CVE IDs?

CVE-2017-9479
https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-22.syseventd.txt

CVE-2017-9480
https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-23.upnp-directory-write.txt


 - Art

• Follow-Ups:
  • RE: Bastille and Comcast CVE IDs
    • From: "Coffin, Chris" <ccoffin@mitre.org>

• Next by Date: RE: Proposed CNA Summit February 13-14, 2018
• Next by thread: RE: Bastille and Comcast CVE IDs
• Index(es):
  • Date
  • Thread