While checking Gentoo bug:

http://bugs.gentoo.org/showbug.cgi?id=250715

I noticed that zoneminder in Fedora defaults to apache:apache 600 for /etc/zm.conf. Therefore, Fedora defaults does now allow reading the config file directly using cat or vim. chmod o-r is probably not much of a fix in setups where local users can run own php or cgi scripts with web server privileges.

However, in such setups, Fedora default seems even worse, as any php or cgi can actually modify the config (and at least break DB connectivity).

In similar cases, where some daemon user needs read access to certain config file, root:<daemongroup> 640 is more common. Please check if changing:

%config(noreplace) %attr(600,%{zmuidfinal},%{zmgidfinal}) %{sysconfdir}/zm.conf

to

%config(noreplace) %attr(640,root,%{zmgidfinal}) %{sysconfdir}/zm.conf

makes sense for ZM.

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file.

SQL injection vulnerability in zmhtmlviewevent.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter.

Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zmhtmlview.php" files.

Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zmhtmlviewevents.php and (2) the runstate parameter to zmhtmlviewstate.php.