| Summary: | Information leak in mail-mta/ssmtp leads to password exposure | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Ben XO <gentoo> |
| Component: | Auditing | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED WONTFIX | ||
| Severity: | minor | CC: | lcars, weyhan |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | B4? | ||
| Package list: | Runtime testing required: | --- | |
| Attachments: | always set minus_v to False when spitting out password | ||
|
Description
Ben XO
2006-05-05 13:28:06 UTC
Created attachment 86218 [details, diff]
always set minus_v to False when spitting out password
does this package originally come from debian...? guess it would need to go upstream. I feel a lot more "comfortable" posting it here though, I don't use Debian for anything. lcars, sounds like another thing for you? please have a look, thanks Reassigning to security since bug-wranglers are not able to see security restricted bugs. Thanks Stefan / Sune, it wasn't obvious to me that ticking "Gentoo Security" was not enough for this bug to be seen by the appropriate assignee. busy this week but I'll try to take a look soon, will try to contact upstream about it. (it would probably require a GLSA as well, or at least I'll vote for it) (In reply to comment #3) > lcars, sounds like another thing for you? please have a look, thanks > No time this and next week to sort this (travelling), so if you have someone else that can look at it please proceed. thx Andrea any news on this one? i reported it upstream with no response or acknowledgement other than the automated debian thingy. either the maintainer's gone awol, or i'm doing something wrong (which is definitely possible :) Any news on this one? The latest I see in portage is now ssmtp-2.61-r31, which by inspecting the ebuild does not appear to patch for this bug 3 months later...? (In reply to comment #12) > 3 months later...? Andrea has been very busy lately and hasn't had much time to look at things -- I suggest you send off a report to the vendor-sec list <vendor-sec@lst.de> as this affects several distributions (Debian, Gentoo, Ubuntu, possibly some others). ok, thanks for your suggestion. I have now done so. :) Sorry, I didn't mean to put unwanted pressure on busy people. Rerating as this seems to be a B4. sorry, but while you may want to take this up with the author, giving random applications sgid and then being able to own them is not a security issue. Obviously I would suggest you ask the author to add support for privileged operation to smtp. RESOLVED => WONTFIX. surely there should be at the very least some documentation that mail-mta/ssmtp is inherently insecure and should not be used in the (perfectly reasonable) configuration i described? i am unlikely to be the only person with a shared system that has a mailhub that requires a password that is using the default Gentoo smtp client. i find it quite disturbing that it's the default client if you do not recommend using it in what seems to me to be a perfectly typical configuration. If you think I should open my concern under a new bug (perhaps as a documentation bug?), then I certainly will. Ben: I think it's a perfectly reasonable feature request, and i see no reason why the author would turn it down, and even if he does, I'm sure you could convince our maintainer to add it..it seems like a good idea to me. I just dont think we can consider this a security bug, if you were to refile it as an application bug, I'm sure the maintainer would take a look at it. *** Bug 187841 has been marked as a duplicate of this bug. *** |
