Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 Mar 2009 19:27:07 +0100
From: Nico Golde <>
Subject: Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap

* Jan Lieskovsky <> [2009-03-23 14:26]:
>   could you please assign CVE ids for following
> two low security issues:
> 1, ucd-snmp / net-snmp snmpd runs with privileges of privileged user
>    a, Red Hat Enterprise Linux / Fedora snmpd runs with UID=0, GID=0
>    b, Debian snmpd runs with GID=0
>    References:

I fail to see the vulnerability in this case. While it's 
obvious that net-snmp shouldn't run with uid 0 if it doesn't 
need it, this is no security issue per-se and would not 
require a CVE id from my opinion.

Nico Golde - - - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.