Subject: [Syslog] New syslog/tcp draft available

From: Chris Lonvick <[email-masked]>
Date: Sun, 30 Jan 2011 09:01:07 -0800 (PST)

Hi Folks,

We've finally gotten around to revising draft-gerhards-syslog-plain-tcp. 
:-)

This addresses the issues that Tom raised about
- the intro specifically stating what to expect in the body of the text
- a note on the transport security.

For the first, we just sort'a straightened things out with a few edits. 
For the latter, I looked in many places for a list of TCP vulnerabilities 
but couldn't find anything substantial.  The US-CERT had a few 
implementation things and there were a scattering of other things.  In the 
end, I just added a subsection to warn impelemters to look closely before 
writing code.  If anyone has any other suggestions, please let us know.

Thanks,
Chris

---

From: Sean Turner <[email-masked]>
Date: Sun, 30 Jan 2011 12:12:25 -0500

Chris,

Not sure if this is what you're looking for, but have you checked out:
http://datatracker.ietf.org/doc/draft-ietf-tcpm-tcp-security/

spt

On 1/30/11 12:01 PM, Chris Lonvick wrote:
> For the latter, I looked in many places for a list of TCP
> vulnerabilities but couldn't find anything substantial. The US-CERT had
> a few implementation things and there were a scattering of other things.
> In the end, I just added a subsection to warn impelemters to look
> closely before writing code. If anyone has any other suggestions, please
> let us know.
>
> Thanks,
> Chris
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/syslog
>

---

From: Chris Lonvick <[email-masked]>
Date: Mon, 31 Jan 2011 18:48:45 -0800 (PST)

Hi Sean,

I've seen that but I don't want this document to sit idle for the next 
couple of years while that matures and becomes a normative and 
stable reference via becoming an RFC.

I'm really thinking that putting in definitive references for transport 
layer vulnerabilities is going a bit beyond what is expected of an 
INFORMATIONAL document.  That being said, I think it's a good idea and am 
willing to pursue it within reason.

Gont's document does reference a paper by Steve Bellovin:
    Bellovin, S. M. 1989.  Security Problems in the TCP/IP Protocol
    Suite.  Computer Communication Review, Vol. 19, No. 2, pp. 32-48.
That may be found here:
   http://portal.acm.org/citation.cfm?id=378449

What would you think about referencing that document as an INFORMATIVE 
reference in the third subsection of the Security Considerations section?

Thanks,
Chris

On Sun, 30 Jan 2011, Sean Turner wrote:

>> : -)