Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Mar 2009 10:08:51 +0100
From: yersinia <>
Subject: Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / 

On Mon, Mar 23, 2009 at 7:27 PM, Nico Golde <> wrote:
> Hi,
> * Jan Lieskovsky <> [2009-03-23 14:26]:
>>   could you please assign CVE ids for following
>> two low security issues:
>> 1, ucd-snmp / net-snmp snmpd runs with privileges of privileged user
>>    a, Red Hat Enterprise Linux / Fedora snmpd runs with UID=0, GID=0
>>    b, Debian snmpd runs with GID=0
>>    References:
> I fail to see the vulnerability in this case. While it's
> obvious that net-snmp shouldn't run with uid 0 if it doesn't
> need it, this is no security issue per-se and would not
> require a CVE id from my opinion.

What is more net-snmp have a specific MAC selinux policy in targeted
mode in Fedora/RHEL. So the full uid=0 is not so important if Selinux
is in enforcing mode.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.