CVE-2008-6755: Medium severity zoneminder vulnerability
While checking Gentoo bug:
http://bugs.gentoo.org/showbug.cgi?id=250715
I noticed that zoneminder in Fedora defaults to apache:apache 600 for /etc/zm.conf. Therefore, Fedora defaults does now allow reading the config file directly using cat or vim. chmod o-r is probably not much of a fix in setups where local users can run own php or cgi scripts with web server privileges.
However, in such setups, Fedora default seems even worse, as any php or cgi can actually modify the config (and at least break DB connectivity).
In similar cases, where some daemon user needs read access to certain config file, root:<daemongroup> 640 is more common. Please check if changing:
%config(noreplace) %attr(600,%{zmuidfinal},%{zmgidfinal}) %{sysconfdir}/zm.conf
to
%config(noreplace) %attr(640,root,%{zmgidfinal}) %{sysconfdir}/zm.conf
makes sense for ZM.
Other sources
ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6755?
The severity of CVE-2008-6755 is considered low, primarily because it involves a misconfiguration rather than an exploit that can be easily leveraged.
How do I fix CVE-2008-6755?
To fix CVE-2008-6755, change the permissions on /etc/zm.conf to a more secure setting that allows appropriate users to read the configuration.
Which software is affected by CVE-2008-6755?
CVE-2008-6755 specifically affects ZoneMinder version 1.23.3 running on Fedora 10.
What happens if CVE-2008-6755 is exploited?
If exploited, CVE-2008-6755 could result in unauthorized access to sensitive configuration information that should be protected.
Is there a workaround for CVE-2008-6755?
A possible workaround for CVE-2008-6755 is to manually set proper file permissions for /etc/zm.conf to limit unauthorized access.