Bug 266947 – <net-analyzer/ntop-3.3.9-r2: Insecure creation of log files

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Alex Legler (RETIRED) 2009-04-21 07:55:05 UTC]

Secunia writes:

A weakness has been reported in ntop, which can be exploited by
malicious, local users to manipulate certain information.

The weakness is caused due to ntop creating the access log file with
world-writable permissions, which can be exploited to modify the
access log information.

Successful exploitation may require that ntop is launched with the
"--access-log-file" and "-d" options.

[Comment 1 Alex Legler (RETIRED) 2009-04-21 07:56:50 UTC]

Created attachment 189024 [details, diff]
Fix from upstream SVN

[Comment 2 Alex Legler (RETIRED) 2009-04-21 08:07:54 UTC]

For reference: http://secunia.com/advisories/34793/

[Comment 3 Alin Năstac (RETIRED) 2009-04-25 09:33:36 UTC]

Fixed in ntop-3.3.9-r2. 
In bug 265704 I've asked for stable keywords. 

[Comment 4 Alin Năstac (RETIRED) 2009-05-02 15:25:11 UTC]

ntop-3.3.9-r2 is stable now.

[Comment 5 Tobias Heinlein (RETIRED) 2009-05-04 06:56:34 UTC]

Ready for vote then, I vote YES.

[Comment 6 Stefan Behte (RETIRED) 2009-06-12 22:27:31 UTC]

I vote NO.

[Comment 7 Alex Legler (RETIRED) 2009-06-22 07:50:35 UTC]

NO, too. Closing