Is not this defect primarily a generic defect rather than an IMM defect?
The fact the the IMM currently is the only service that has adopted access
control does not mean that any defect discovered in the access control
mechanism is an imm defect.
The imm may need additional adaption when a fix has been made for this
problem. But the fix should be available to all services that later
adopt access control.
My point is that you should strive to keep as much as possible of the
fix for this ticket in the generic opensaf libraries. This so that the
adoption by each service becomes as simple as possible and code replication
beteween the services is minimized.
---
** [tickets:#1163] IMM: no verification of handle and msg source correlation**
**Status:** unassigned
**Milestone:** 4.5.1
**Created:** Wed Oct 08, 2014 04:03 PM UTC by Hans Feldt
**Last Updated:** Wed Oct 08, 2014 04:03 PM UTC
**Owner:** nobody
This is a continuation of https://sourceforge.net/p/opensaf/tickets/938/
Each message received that contains a handle must be verified to be from the
correct mds source to prevent package spoofing.
---
Sent from sourceforge.net because [email protected] is
subscribed to https://sourceforge.net/p/opensaf/tickets/
To unsubscribe from further messages, a project admin can change settings at
https://sourceforge.net/p/opensaf/admin/tickets/options. Or, if this is a
mailing list, you can unsubscribe from the mailing list.
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Opensaf-tickets mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-tickets
