RE: CVE request: nullmailer world readable /etc/nullmailer/remotes

["Christey, Steven M." <coley () mitre org>]

Agostino,

Out of curiosity, what types of sensitive information are contained in this file that cause world-readable permissions 
to pose a vulnerability?

- Steve


> -----Original Message-----
> From: Agostino Sarubbo [mailto:ago () gentoo org]
> Sent: Friday, August 09, 2013 1:15 PM
> To: oss-security () lists openwall com
> Subject: [oss-security] CVE request: nullmailer world readable
> /etc/nullmailer/remotes
>
> Hello,
>
> On Gentoo, the file /etc/nullmailer/remotes is installed with wrong
> permissions:
>
> ~ # ls -la /etc/nullmailer/remotes
> -rw-r--r-- 1 root root 971 Aug  9 18:58 /etc/nullmailer/remotes
>
> Nullmailer-1.11-r2 contains the fix, all prior versions are affected.
>
> Please assign a CVE.
> --
> Agostino Sarubbo
> Gentoo Linux Developer