Re: CVE Request -- logrotate -- nine issues

["Steven M. Christey" <coley () rcf-smtp mitre org>]

If there's a common usage scenario that doesn't stem from blatant 
administrator negligence, then a CVE is probably still appropriate. 
("blatant admin negligence" might be, say, if an admin arbitrarily makes a 
script setuid, or modifies the perms for an executable or config file to 
be world-writable.)

We will sometimes write the CVE description more as an "adminisrator 
practice" than as "fault of the software."

For example, default passwords are fair game; arguably, if the admin 
didn't read page 24 of the documentation that said "change the default 
password," this is more the admin's fault than the software's fault... BUT 
the issue has to be dealt with, either way, so a CVE becomes a "signal" 
for that action to take place, whether it came from the software or from 
the user.

Not everything is that clean and straightforward of course, but that's the 
general thinking.

- Steve