[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 Mar 2009 19:27:07 +0100
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap
Hi,
* Jan Lieskovsky <jlieskov@...hat.com> [2009-03-23 14:26]:
> could you please assign CVE ids for following
> two low security issues:
>
> 1, ucd-snmp / net-snmp snmpd runs with privileges of privileged user
> a, Red Hat Enterprise Linux / Fedora snmpd runs with UID=0, GID=0
> b, Debian snmpd runs with GID=0
> References:
> https://bugzilla.redhat.com/show_bug.cgi?id=491621
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520724
I fail to see the vulnerability in this case. While it's
obvious that net-snmp shouldn't run with uid 0 if it doesn't
need it, this is no security issue per-se and would not
require a CVE id from my opinion.
Cheers
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
