Subject: [MIB-DOCTORS] Readable and MAXACCESS

From: Glenn Mansfield Keeni <[email-masked]>
Date: Fri, 14 Sep 2018 20:10:16 +0900

Hi,
   The Security Guidelines for IETF MIB modules says
    Some of the readable objects in this MIB module (i.e., objects
    with a MAX-ACCESS other than not-accessible) may be considered
    sensitive or vulnerable in some network environments.

This seems to imply that objects that have MAX-ACCESS not-accessible
are not "readable". But the objects can very well be "read" from the
index, if the MO is an index object.
Then "not-accessible" objects too may be sensitive or vulnerable ?
Have I missed something.

Glenn

---

From: Randy Presuhn <[email-masked]>
Date: Fri, 14 Sep 2018 14:19:54 -0700

Hi -

> Then "not-accessible" objects too may be sensitive or vulnerable ?

Yes.  The sensitivity of indexes needs to be considered in
the formulation of an access control policy.

Randy

---

From: Glenn Mansfield Keeni <[email-masked]>
Date: Sat, 15 Sep 2018 08:45:44 +0900

Hi,
 > the formulation of an access control policy.
Thanks. Agreement on that. But I think that there is an
additional issue.
Even with appropriate access control policy, if
appropriate encryption is not used index objects may
reveal/leak information (to an eavesdropper) . e.g. in
the tcpConnTable the index objects
               tcpConnLocalAddress,
               tcpConnLocalPort,
               tcpConnRemAddress,
               tcpConnRemPort
reveal the existence of a connection/conversation.
Or, in the usmUserTable the index usmUserName reveals the
userName. (Note that userName has MAX-ACCESS not-accessible.)

So, does the following sentence in the The Security Guidelines
for IETF MIB modules needs rewording?

 >>     sensitive or vulnerable in some network environments.

Would the following be appropriate ?
      Some of the readable objects in this MIB module (i.e., objects
      with a MAX-ACCESS other than not-accessible and objects that are
      visible as indices) may be considered
      sensitive or vulnerable in some network environments.
Glenn

On 2018/09/15 6:19, Randy Presuhn wrote:
> _______________________________________________
> MIB-DOCTORS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mib-doctors
>

---

From: Randy Presuhn <[email-masked]>
Date: Fri, 14 Sep 2018 17:27:54 -0700

Hi -

On 9/14/2018 4:45 PM, Glenn Mansfield Keeni wrote:
...
> appropriate encryption is not used index objects may

Access control policy specifies whether encryption is to
be used.  See RFC 3415, look for "securityLevel" to find
explanations, and the vacmAccessSecurityLevel index into
vacmAccessTable for the actual configuration.  One cannot
(in VACM) specify an access control policy without
also specifying the securityLevel(s) to which that policy
applies.

...
>       sensitive or vulnerable in some network environments.
...

A simpler fix would be to change the "i.e." to "e.g."

Randy

---

From: Glenn Mansfield Keeni <[email-masked]>
Date: Sat, 15 Sep 2018 10:19:46 +0900

Hi,
 > be used.
Got this!
 > A simpler fix would be to change the "i.e." to "e.g."
Brilliant. I like it!
Thanks a lot. That was very helpful.

Glenn

On 2018/09/15 9:27, Randy Presuhn wrote:
>>  >>     Some of the readable objects in this MIB module (i.e., objects
>>  >>     with a MAX-ACCESS other than not-accessible) may be considered
>>  >>     sensitive or vulnerable in some network environments.
>>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 15 Sep 2018 09:08:43 +0200

> Thanks a lot. That was very helpful.

The proper fix would then be to update

  https://trac.ietf.org/trac/ops/wiki/mib-security

but this requires an AD who cares and takes action (unfortunately not
too likely at the moment).

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>

---

From: Glenn Mansfield Keeni <[email-masked]>
Date: Sat, 15 Sep 2018 16:21:57 +0900

Hi,
 >    https://trac.ietf.org/trac/ops/wiki/mib-security
Absolutely! I was going to come to that. I see that you
have CC-ed to Ignas Bagdonas. Thanks.

Glenn