Rather distrubingly, BOINC binds to all network adaptors rather than just localhost, despite the
allow_remote_gui_rpc setting not being set.

As an end-user, I would have expected just for it to bind to the localhost for availability for the boinc-manager.

While there is not an explicity security issue here, because no hosts/ip's are listed in the remote authorisation
file, there is an implicit one and that is if there is ever a buffer overflow against boinc then it's possible that
is going to be exploited by other people.

Netstat output:
tcp        0      0 0.0.0.0:31416           0.0.0.0:*               LISTEN      20006/boinc
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      3126/cupsd

You can see where cupsd for example has bound locally and boinc has bound globally.

If I can be of any further assistance then please don't hesistate to let me know.

tags 514303 + upstream
forwarded 514303 http://boinc.berkeley.edu/trac/ticket/573
thanks

Hi Sheridan,
And thanks for your bug report.

Indeed, is a kind of an ugly default behaviour.
and if you check the Checkin_notes from 2005, you see that rather than be a bug
for upstream this was a _bug fix_


However, I was looking over upstream bug reports, and this feature was already
requested[0] a few months ago.

Sure!

[0] http://boinc.berkeley.edu/trac/ticket/573

Cheers

2009/2/10 René Mayorga <rmayorga@debian.org>:

Hello René,

I have been upstream to check out that ticket.

What I cannot understand is that the Windows version of BOINC does in
fact bind just to the localhost and not network adaptors by default.
I have no idea why this needs to be different between OS's.

Given that upstream has already commented I have decided to remove the
linux version of BOINC from all my machines, so I recommmend closing
this bug report.

Thank you for your timely efforts, it's a pleasure to deal with a
responsive developer.

"What I cannot understand is that the Windows version of BOINC does in
fact bind just to the localhost and not network adaptors by default."

That isn't true, unless it has changed in the last four years, but I
have never had to tell any BOINC client to pick an interface on any OS,
and that is preferred.

It is such a minor thing I'm not surprised upstream wasn't interested.