RE: Fw: MIB Doctor review: publishdraft-ietf-disman-remops-mib-v2-06.tx t

I agree with Juergen on this one.Tracepath information, even if read-only, is considered to be privacy sensitive in many environments. 

To quote from http://www.ietf.org/internet-drafts/draft-ietf-ops-mib-review-guidelines-04.txt, Section 3.4:

  Each specification that defines one or more MIB modules MUST contain
   a section that discusses security considerations relevant to those
   modules.  This section MUST be patterned after the latest approved
   template (available at http://www.ops.ietf.org/mib-security.html).
   In particular, writeable MIB objects that could be especially
   disruptive if abused MUST be explicitly listed by name and the
   associated security risks MUST be spelled out;  similarly, readable
   MIB objects that contain especially sensitive information or that
   raise significant privacy concerns MUST be explicitly listed by name
   and the reasons for the sensitivity/privacy concerns MUST be
   explained.  

It looks like this is one of the cases where the objects 'MUST be explicitly listed by name and the reasons for the sensitivity/privacy concerns MUST be explained.'  



Regards,

Dan



> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]]On Behalf Of Randy Presuhn
> Sent: 04 May, 2005 6:56 AM
> To: Disman
> Subject: [Disman] Fw: MIB Doctor review: 
> publishdraft-ietf-disman-remops-mib-v2-06.tx t
> 
> 
> Hi -
> 
> Forwarded for your information.
> 
> Randy
> 
> ----- Original Message ----- 
> > From: "Juergen Schoenwaelder" <[email protected]>


....

> >
> > 5.  Security Considerations
> >
> > - The following is stated:
> >
> >    However, the only information that might be
> >    disclosed is the configuration and results of 
> measurements that are
> >    performed by implementations of the MIB modules.  This 
> information
> >    can only be mis-used in conjunction with the mis-use of further
> >    information.
> >
> >   I am not sure what the last sentence hints at. It sounds 
> like it is
> >   trying to make this less a security problem. Note sure 
> this is true.
> >   Tracepaths reveals information about paths which some 
> people tend to
> >   block (actually becoming more and more popular in enterprise
> >   networks it seems).
> >
> >
> > -- 
> > Juergen Schoenwaelder     International University Bremen
> > <http://www.eecs.iu-bremen.de/>     P.O. Box 750 561, 28725 
> Bremen, Germany
> 
> 
> 
> 
>