[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <10596047.0VGe0Aa3mR@arcadia>
Date: Mon, 07 Apr 2014 22:00:10 +0200
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: Tim Heckman <tim+sec@...erduty.com>, cve-assign@...re.org
Subject: Re: CVE request: Icecast world readable log/logdir
On Sunday 06 April 2014 20:32:35 Tim Heckman wrote:
> Hello Agostino,
>
> I agree that world-readable log files is a problem and should be fixed.
> However, should this be given a CVE?
>
> Do those log files contain any information that would be considered a
> security risk? It's been quite a few years, admittedly, since I've worked
> with Icecast so I don't remember if those files contain any information
> that could be considered a problem.
The access log looks to be very similar to a webserver access log which
deserved a cve in the past.
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
