Re: CVE request: Icecast world readable log/logdir

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/07/2014 02:00 PM, Agostino Sarubbo wrote:
> On Sunday 06 April 2014 20:32:35 Tim Heckman wrote:
> > Hello Agostino,
> >
> > I agree that world-readable log files is a problem and should be
> > fixed. However, should this be given a CVE?
> >
> > Do those log files contain any information that would be
> > considered a security risk? It's been quite a few years,
> > admittedly, since I've worked with Icecast so I don't remember if
> > those files contain any information that could be considered a
> > problem.
>
> The access log looks to be very similar to a webserver access log
> which deserved a cve in the past.

Basically from my understanding of CVE:

world readable log file with sensitive information in it? Gets a CVE.

world readable log file, nothing sensitive in it? Hardening, no CVE.

Now what defines "Sensitive"? Some services MUST log sensitive
information to be useful, e.g. WWW logs with the GET request which can
contain form data passed via GET. Some will almost never log sensitive
information unless placed into debug mode for example. So there is a
huge grey are in the middle. This is offset by the occasional bug like
"Service X log password under weird condition Y" which then makes that
world readable log file a problem.

This also applies to configuration files, some are fine to be readable
(/etc/passwd) and some are not fine to be readable (/etc/shadow).

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJTRGCdAAoJEBYNRVNeJnmTlFkP/jAuknMtFwTALMrqDQjzsS6b
KzLGT96pz7JATP40gRosCbkMh/NLfLybozgnAzAn5Ls/R3mZxGzD8iHqp7ytTkPI
L1zl3ftTzk7s1wDhCbxIuqnMb1+3Z+SuJ0zJXFY5qjhX+Uo1wX8xO1bSrrltwIrB
NA9PBXZIuHynNt/osSyKrzADpUyW189dpYdvLgWYEGzF05Q6J0UFeyXhDPP5CZ/m
BaN4ZnSzLF+xTfV6FlszU2omHHhpL41qlof+VSw4ykgYCg879fAlWxOp0gsqkffU
XJChxemQp8ImojWpfsnGt1r1Ioe0GU0r2uF6vAxC3Vq7HQnyLlRzyajTscPLh4U1
3AC8RAv+PHQFkZQFeVnhvr2i0J/Zwp92Cq0r1GxDK/G0u8rzqEuUeUghAm/wdHE9
ukVMKIaBgr7TfcetnDC146q2HOKlR73GdxFVSAf2TsthceGdMT+GE0GtBUVQjRnc
qhR7A/P3IJZuIrfn+91qo37oSPNnQw3MOfsHU47WoTev12AEXC10DOPbw3Jkiexy
k0qXuPUJTDHJRLhn9XdYst4xFixTBVZx6AlcHrwgnAm/q0bAvZWmxiU7g5AU2Yws
DDtGsbgbTbCcwhvclM2/SrIl5aBEoZCngOUVH+pmNqM1nPqYNNw9oQdBjsFkX9Q7
MT3LVpASQLfUW4fK24qO
=FFzl
-----END PGP SIGNATURE-----