New feature: zeroconf networking by default, please test

[Martin Pitt]

Hi,

Sivan Greenberg [2006-12-17 11:04 +0200]:
> So my machine would be found and accessed from the local link network 
> *only* if I actively enable a service? 

No, this is independent from enabled services. It gives away your
IPv4ll IP address and unqualified hostname, nothing else.

> Are there any "by-default" services that could be up and running
> without user's knowledge and potentially allow data theft or
> exploitation if circumvented ?

'Services' in terms of sharing application-level data: no, this is
forbidden by our new policy [1]. 

In terms of processes listening to the network: yes, there are: the
DHCP client (has always been so, since Warty), and the Avahi daemon
(now enabled by default in Feisty).  dhclient runs as normal user, and
potential vulnerability impact is arbitrary network reconfiguration
and access to file system as (relatively unprivileged) 'dhcp' user. 

Avahi daemon is pretty tight, potential vulnerability impact is
injection of false knowledge about other machines' services into
avahi's brain (not a big deal, other computers can achieve this much
easier by just sending out bogus service announcements over the
regular DNS-SD protocol), and of course a DoS in the sense of crashing
the Avahi daemon itself or abusing it to consume CPU power. The daemon
is chrooted and runs as an unprivileged system user, thus file system
access is really uninteresting.

If you have application-level services that run without the user's
knowledge (be that ssh, apache, or whatever) then other computers can
exploit those independently of avahi. avahi is just a directory
service, thus makes potential targets easy to find.

Pitti
 
[1] https://wiki.ubuntu.com/DefaultNetworkServices

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-devel/attachments/20061217/45c9d971/attachment.pgp