[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150409215021.8AF026C0056@smtpvmsrv1.mitre.org>
Date: Thu, 9 Apr 2015 17:50:21 -0400 (EDT)
From: cve-assign@...re.org
To: astieger@...e.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request for ceph-deploy world-readable keyring permissions
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> The 1.5.23 changelog states:
> "Fix an issue where keyring permissions were world readable"
> The problem was that the keyring file would be created with 644 mode. If
> ceph-deploy was run as a dedicated non-root admin user, the keys would
> be readable to all other (non-admin) users of the same group, thus
> leaking authentication credentials.
> https://github.com/ceph/ceph-deploy/pull/272
> https://github.com/ceph/ceph-deploy/commit/eee56770393bf19ed2dd5389226c6190c08dee3f
> https://bugzilla.suse.com/show_bug.cgi?id=920926
We were initially puzzled by "644 mode" in combination with "readable
to ... the same group." Possibly the unstated expectation is that user
home directories have 0750 permissions.
The security issue, in general, is that the file permissions are 644,
and the directory permissions (whatever they might be) do not
necessarily prevent read access to the file. Use CVE-2015-3010 for
this issue.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVJvOZAAoJEKllVAevmvmsuw4H/2r6kpfMcOt/xb6h4mMq0z7t
+4Odeiyj1PGn8pVS6pcrTBu2hu8f8YnQgWXWvpPJR4hpKx83JS2n/Dk6AfKkCs9V
TBz15JS6wqOy5Lke4r2Y2hOLXl/pItf683uh3YZr0s+w+hgjy3xuHpuTJ3FSO0lO
BKQL+smh5usT0Ks/tNCmcCnGrLD71z7GFaSnYXLVhv6UEuFNxQv/OmXCfJxeFm1O
gvXjUbSoYm7RgDGNJp40W4rmGmLu5RW4mxfVA0oZ1OOhX5E1/A0a3nu0shzMI+fU
rSd6yK7LufCkoMyOynHrS/EnljCo/nGZneOfyuWDF5FBAt12FZcWjR0Wi1eQfwc=
=HMxR
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
