[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <c4c734f10429230cd935943fd025597b223e027c.camel@orlitzky.com>
Date: Tue, 06 Aug 2024 11:10:06 -0400
From: Michael Orlitzky <michael@...itzky.com>
To: oss-security@...ts.openwall.com
Subject: Tracking down a lost CVE request (MITRE)
Couldn't think of a better place to ask this. I requested a CVE back in
March for an issue with the installed permissions in Nagios's NDOUtils.
I think the request ID was #1620090.
I received a confirmation, but never got a follow-up response. I've
since replied to the CVE-Request@ address, and have filled out the form
with an "other" request asking for an update, but haven't heard back.
New requests are obviously still being issued -- is there some way to
find out what happened to this one?
FWIW:
Before NDOUtils-2.1.4 (released five days ago), the upstream Makefile
would install the "ndo2db" daemon executable with the same owner/group
that it is intended eventually to run as (namely: "nagios"). But the
daemon is designed to be started as root and drop privileges to that
user. If the "nagios" user can edit a binary that root will run, he can
gain root privileges.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
