[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 30 Jun 2015 10:32:56 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: cve-assign@...re.org
CC: oss-security@...ts.openwall.com
Subject: Re: Question about world readable config files and commented warnings
On 06/30/2015 09:55 AM, cve-assign@...re.org wrote:
>> # Database URI for the database that stores the package information. If it
>> # contains a password, make sure to adjust the permissions of the config
>
> In the "If it contains a password, make sure" scenario that you
> mentioned, it seems entirely reasonable for the default permissions to
> reflect the author's preference for the normal case. (A password in a
> URI might be rare.) In other words, the author may want to optimize
> for situations where configuration data is read by users or
> administrators who login with an unprivileged account for most
> day-to-day work. Alternatively, in some cases a configuration approach
> could be redesigned to use separate files for sensitive data elements.
Ok, so does a situation where the author creates the config file with
that warning, and then a vendor repackages and ships it, still world
readable, still with the warning, warrant a CVE?
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
