Re: CVE request: Debian's package "mysql-server" leaks credential information

[larry Cashdollar <larry0 () me com>]

According to the bug report details that's a race condition.  A malicious user is using a vulnerability in the way the 
installation script handles changing file permissions to disclose sensitive information.  

Larry C$

On Jun 8, 2013, at 7:00 AM, gremlin () gremlin ru wrote:

> On 08-Jun-2013 12:44:45 +0200, vladz wrote:
>
> > The file "/etc/mysql/debian.cnf", which contains plain text
> > credentials for the "debian-sys-maint" mysql user, is created
> > in an insecure manner during the package installation phase.
> > This can lead a non-privileged local user to disclose its content
> > and use this special account to perform administration tasks.
> > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711600
> > Could you allocate CVE id for this issue?
>
> That's not a security issue, but a misconfiguration (alas, very common
> for Deb*an packages), so at least I doubt that deserves a CVE.
>
>
> -- 
> Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
> GPG key ID: 0xEF3B1FA8, keyserver: hkp://subkeys.pgp.net
> GPG key fingerprint: 8832 FE9F A791 F796 8AC9 6E4E 909D AC45 EF3B 1FA8