CVE-2008-6755
First published: Mon Dec 15 2008(Updated: )
While checking Gentoo bug: <a href="http://bugs.gentoo.org/show_bug.cgi?id=250715">http://bugs.gentoo.org/show_bug.cgi?id=250715</a> I noticed that zoneminder in Fedora defaults to apache:apache 600 for /etc/zm.conf. Therefore, Fedora defaults does now allow reading the config file directly using cat or vim. chmod o-r is probably not much of a fix in setups where local users can run own php or cgi scripts with web server privileges. However, in such setups, Fedora default seems even worse, as any php or cgi can actually modify the config (and at least break DB connectivity). In similar cases, where some daemon user needs read access to certain config file, root:<daemon_group> 640 is more common. Please check if changing: %config(noreplace) %attr(600,%{zmuid_final},%{zmgid_final}) %{_sysconfdir}/zm.conf to %config(noreplace) %attr(640,root,%{zmgid_final}) %{_sysconfdir}/zm.conf makes sense for ZM.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoneminder Zoneminder | =1.23.3 | |
| Redhat Fedora | =10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00204.html
- https://bugzilla.redhat.com/show_bug.cgi?id=476529
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50324
- http://bugs.gentoo.org/show_bug.cgi?id=250715
- http://admin.fedoraproject.org/updates/zoneminder-1.23.3-2.fc10
- http://admin.fedoraproject.org/updates/F10/FEDORA-2008-11484
- https://access.redhat.com/security/cve/CVE-2008-6755
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6755
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=476529
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/description
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-6755
- vendor/zoneminder
- canonical/zoneminder zoneminder
- version/zoneminder zoneminder/1.23.3
- vendor/redhat
- canonical/redhat fedora
- version/redhat fedora/10