Published December 22, 2022
| Version v5
Report
Open
OID Takeover due to IANA's-PEN-Modification-Request Improper Access Control
Description
Ability of adversary to takeover entries of ICANN'S IANA's OID Registry due to improper authentication, authorization and access control.
There has been a Coordinated Vulnerability Disclosure attempt (CVD) with ICANN (and IANA), but there was no response.
Even though there have been, at least, two (2) attempts to register a Common Vulnerabilities and Exposures (CVE) Number by The Mitre Corporation (MITRE), there has been no meaningful response.
Notes
The original license in the PDF's metadata is "Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)" (https://creativecommons.org/licenses/by-nc-sa/4.0/). To clarify, the file is re-licensed according to the information of this DOI ("Creative Commons Attribution 4.0 International" (http://creativecommons.org/licenses/by/4.0/)).
Files
IANA OID CVE Request.pdf
Files
(2.5 MB)
| Name | Size | Download all |
|---|---|---|
|
md5:e1f4737c63b00d5ac31314b2e9416548
|
1.5 MB | Preview Download |
|
md5:91de42d7f2aa23ac47495b2f796234f4
|
927.2 kB | Preview Download |