Bug 288221 (CVE-2007-5495)
Summary: | CVE-2007-5495 setroubleshoot insecure logging | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Mark J. Cox <mjc> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | dwalsh, jdennis, kreilly, sgrubb |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2008-05-29 07:52:44 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 421791 | ||
Bug Blocks: |
Description
Mark J. Cox
2007-09-12 18:48:53 UTC
This is already addressed in the current upstream, the file is no longer created. What about RHEL5.1's version? The RHEL 5.1 version is the same as 5.0. It would be trival to patch RHEL to turn off creation of this log file. The only way for security sensitive information to be written to the file would be if the verbose debug logging was turned on, but that requires root privledge to modify the configuration. Tracebacks due to program exceptions which might be written to the file do not contain user data. removing embargo John, can you please clarify which upstream setroubleshoot version first fixed this flaw? I see /tmp/sealert.log defined in config.py in 1.8.11 and is no longer set in 1.9.4, but I fail to find versions in between to check which version was the first to include this change. No, I don't recall the exact version this first appeared in. If it's important I could research it. Probably not if you agree with the assessment that fix occurred somewhere in between 1.8.11 and 1.9.4, so that I managed to identify the right change that was used to resolve this issue. Is there any place where all previous upstream versions can be found? This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0061.html |