oss-security - Re: Question about world readable config files and commented warnings

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 30 Jun 2015 11:55:05 -0400 (EDT)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Question about world readable config files and commented warnings

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> # Database URI for the database that stores the package information. If it
> # contains a password, make sure to adjust the permissions of the config

The scope of CVE typically does not include opportunities for
improvements to file permissions. In some cases, these are covered in
CCE, e.g.,

  http://static.nvd.nist.gov/feeds/cce/cce-apache-httpd2.2-5.20130214.xls

  CCE-27780-6

  CCE Description

  Access to Apache's httpd.conf file should be configured appropriately.

  CCE Technical Mechanisms

  defined by (ServerRoot)\conf\httpd.conf's DACL  

  (httpd.conf is often a non-sensitive file.)

The scope of CVE does include implementation errors that the author of
a product wishes to announce as a vulnerability. So, for example, the
author of this:

  # Install binaries with mode 0755.
  install -m 0755 "$SRC/bin/mybinary1" "$DST/bin/mybinary1"
  install -m 0755 "$SRC/bin/mybinary2" "$DST/bin/mybinary2"

  # Install config files with mode 0600. IMPORTANT!
  install -m 0755 "$SRC/etc/myconf1.conf" "$DST/etc/myconf1.conf"
  install -m 0755 "$SRC/etc/myconf2.conf" "$DST/etc/myconf2.conf"

could ask for a CVE ID.

In the "If it contains a password, make sure" scenario that you
mentioned, it seems entirely reasonable for the default permissions to
reflect the author's preference for the normal case. (A password in a
URI might be rare.) In other words, the author may want to optimize
for situations where configuration data is read by users or
administrators who login with an unprivileged account for most
day-to-day work. Alternatively, in some cases a configuration approach
could be redesigned to use separate files for sensitive data elements.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVkrtEAAoJEKllVAevmvmsMPQH/1soaBh2VkpoRtGYFcjqCv9g
m//oc6mAOVEVaoAH+OoLGdblKX4kgq2mVTXkA2I1z094lgpBa3oylkB2IFxJty6I
y2N431SsObhkB6PUhFJCeC51H3QEBJ2Hi1cofSg4F5SxWjqKU3RM+kjOw7+evmtU
w447IaR9rp2wuJ81OO/+AjMEwubUQCsSlJPvpphOizLw1cSB4LGE55aolfTdzLRf
tyGvHtS4igtyysb7HHxG8HGJPcssEAv01W+wBvolFfEBFe6B1dCcPPuYYchffKVp
Bpqg1C5iAuPBxjnlsz93pT5yKS0MzXGAwb/nmSPB91TGvXcQnF/3qQxxTldECkw=
=tJ2b
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.