Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 1 Aug 2016 14:19:59 -0700
From: Grant Ridder <shortdudey123@...il.com>
To: oss-security@...ts.openwall.com
Cc: seb@...ian.org, CVE ID Requests <cve-assign@...re.org>, mongodb-user@...glegroups.com
Subject: Re: Re: CVE request: mongodb: world-readable .dbshell
 history file

FWIW, the vendor has closed https://jira.mongodb.org/browse/SERVER-25335
with "Works as Designed"

-Grant

On Fri, Jul 29, 2016 at 10:28 AM, <cve-assign@...re.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908
> >
> > | During the report on redis-tools
> > | (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460), lamby@
> > | linked to a codesearch and the same bug was found in mongodb-clients.
> > |
> > | mongodb-clients stores its history in ~/.dbshell, this file is created
> > | with permissions 0644. Home folders are world readable as well in
> > | debian, so any user can access other users mongodb history, even though
> > | db.auth commands don't appear to be logged like redis did.
> > |
> > | I filed a bug on upstream as well:
> > | https://jira.mongodb.org/browse/SERVER-25335
> >
> > The mongodb client doesn't store authentication commands, but there's
> > still information leakage, though, even if only about database and
> > collection names, or data structure.
> >
> > As for data itself, the history could also contain sensitive
> > information; for instance, if usernames for some other service were
> > stored in a mongo collection, the history could contain lines like:
> >
> >   db.users.find({user:"foo"})
> >
> > or even:
> >
> >   db.users.update({user:"foo"},{$set:{password:"OhComeOnNow"}})
>
> Use CVE-2016-6494.
>
> - --
> CVE Assignment Team
> M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
> [ A PGP key is available for encrypted communications at
>   http://cve.mitre.org/cve/request_id.html ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCAAGBQJXm5HHAAoJEHb/MwWLVhi20SgQAKIXsSDuAQzAY3DN67osMxAg
> BuEh9En380VzBzqz+O83tjJyqJ6kx+Ed9WWc6Yl4nd0rUW1YdnOSvK+RF1c0nN2s
> ndfb3cHkC2sTCfJyh5GvDdthYLr0Th0GabAzmgOoc4QhCSHykxxGFHgEhI5Wem6T
> MclVy95MpBRb3g2XNH2ue96CxRFK2buT3fZerewZe8OBh7dh6nxDEKfLKodz8zaK
> vUgINsgoP53GuhlCJYExf9O4JLY2wn3CFjWTGfoMY7wDxl9Rr5VwOuBaSgO6i+Ay
> MxjMApDumENwSBtXtUQ/54WPez4IxqWU193gq31V4kVWEfBvlb9QHUsd1qyWsQVp
> OtboCgvY2K0u5O9ZVK/H+zJDhqe/fxw2HjMxlwju3ENORuCUFpz/nErLWXSc+iaj
> C2WmJPD0O+8mzJnOCjY8WuHJtetGorivbbKTbWk2C5r3NHMI7X9DYKiiz5ISD6Us
> kXVjWxXdHqfCVG3JvpmJi78Pw/+DPgw9D3sg4BTY+bhEB+Gguvh8TMVTkjtOSsBh
> i5ORa+1EhvGhYVXVZJZUK0bvEH/Pxuh6Yc2WX8LWFG2Fauw5d+1sSovLls6oLnp7
> xDXqv7DN6NTu3iza24JWfsZBOUTVKminX42EonOu7yOVtW5oIRO6wCALd0OiL/SP
> EOsVcn9sPCF9HQog0jSZ
> =OQs9
> -----END PGP SIGNATURE-----
>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.