[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <b086760e0903240208u2f378674t954c54ea146b063a@mail.gmail.com>
Date: Tue, 24 Mar 2009 10:08:51 +0100
From: yersinia <yersinia.spiros@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd /
nss_ldap
On Mon, Mar 23, 2009 at 7:27 PM, Nico Golde <oss-security+ml@...lde.de> wrote:
> Hi,
> * Jan Lieskovsky <jlieskov@...hat.com> [2009-03-23 14:26]:
>> could you please assign CVE ids for following
>> two low security issues:
>>
>> 1, ucd-snmp / net-snmp snmpd runs with privileges of privileged user
>> a, Red Hat Enterprise Linux / Fedora snmpd runs with UID=0, GID=0
>> b, Debian snmpd runs with GID=0
>> References:
>> https://bugzilla.redhat.com/show_bug.cgi?id=491621
>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520724
>
> I fail to see the vulnerability in this case. While it's
> obvious that net-snmp shouldn't run with uid 0 if it doesn't
> need it, this is no security issue per-se and would not
> require a CVE id from my opinion.
What is more net-snmp have a specific MAC selinux policy in targeted
mode in Fedora/RHEL. So the full uid=0 is not so important if Selinux
is in enforcing mode.
Regards
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
