But I dont believe it is the handle tha is the key here.
Anyone can fake a handle probably.
The check needed is that the any message that arrives has been sent from an MDS
dest/source that has been authenticated.
/AndersBj
________________________________
From: Hans Feldt [mailto:[email protected]]
Sent: den 9 oktober 2014 09:01
To: [opensaf:tickets]
Subject: [opensaf:tickets] #1163 IMM: no verification of handle and msg source
correlation
I guess one problem is that handles are service specific. MDS cannot do this
check for a service. But I haven't really looked at a solution. This was just a
placeholder so that it is not forgotten.
________________________________
[tickets:#1163]<http://sourceforge.net/p/opensaf/tickets/1163> IMM: no
verification of handle and msg source correlation
Status: unassigned
Milestone: 4.5.1
Created: Wed Oct 08, 2014 04:03 PM UTC by Hans Feldt
Last Updated: Thu Oct 09, 2014 06:50 AM UTC
Owner: nobody
This is a continuation of
https://sourceforge.net/p/opensaf/tickets/938/<https://sourceforge.net/p/opensaf/tickets/938>
Each message received that contains a handle must be verified to be from the
correct mds source to prevent package spoofing.
________________________________
Sent from sourceforge.net because you indicated interest in
https://sourceforge.net/p/opensaf/tickets/1163/<https://sourceforge.net/p/opensaf/tickets/1163>
To unsubscribe from further messages, please visit
https://sourceforge.net/auth/subscriptions/<https://sourceforge.net/auth/subscriptions>
---
** [tickets:#1163] IMM: no verification of handle and msg source correlation**
**Status:** unassigned
**Milestone:** 4.5.1
**Created:** Wed Oct 08, 2014 04:03 PM UTC by Hans Feldt
**Last Updated:** Thu Oct 09, 2014 07:00 AM UTC
**Owner:** nobody
This is a continuation of https://sourceforge.net/p/opensaf/tickets/938/
Each message received that contains a handle must be verified to be from the
correct mds source to prevent package spoofing.
---
Sent from sourceforge.net because [email protected] is
subscribed to http://sourceforge.net/p/opensaf/tickets/
To unsubscribe from further messages, a project admin can change settings at
http://sourceforge.net/p/opensaf/admin/tickets/options. Or, if this is a
mailing list, you can unsubscribe from the mailing list.
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Opensaf-tickets mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-tickets
