CVE-2014-3800 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3800): XBMC 13.0 uses world-readable permissions for .xbmc/userdata/sources.xml, which allows local users to obtain user names and passwords by reading this file.
Looks like the target fix is version 17.0... @maintainer(s), can you confirm if this is resolved in the current beta? http://trac.kodi.tv/ticket/15198
Upstream hasn't fixed the problem yet. Milestone was only adjusted.
@maintainer(s), can you confirm if this is resolved in the current? Are we safe to send to glsa?
This issue has not been resolved. ~/.kodi/userdata/sources.xml is still world readable so the CVE should still be open. I'm talking to upstream now to get them to address it.
(In reply to Craig Andrews from comment #4) > This issue has not been resolved. > ~/.kodi/userdata/sources.xml is still world readable so the CVE should still > be open. I'm talking to upstream now to get them to address it. Can this be fixed in post install?
(In reply to Aaron Bauman from comment #5) > (In reply to Craig Andrews from comment #4) > > This issue has not been resolved. > > ~/.kodi/userdata/sources.xml is still world readable so the CVE should still > > be open. I'm talking to upstream now to get them to address it. > > Can this be fixed in post install? Since the file in question is in the user's home directory, I can't think of how the ebuild could find it (since it doesn't know all the users and their home directories). Also, the file isn't created until the user runs Kodi, so even if the ebuild did know it would be, it wouldn't be there until first run. I'm open to suggestions (and corrections, if I'm wrong, of course).
(In reply to Craig Andrews from comment #6) > (In reply to Aaron Bauman from comment #5) > > (In reply to Craig Andrews from comment #4) > > > This issue has not been resolved. > > > ~/.kodi/userdata/sources.xml is still world readable so the CVE should still > > > be open. I'm talking to upstream now to get them to address it. > > > > Can this be fixed in post install? > > Since the file in question is in the user's home directory, I can't think of > how the ebuild could find it (since it doesn't know all the users and their > home directories). Also, the file isn't created until the user runs Kodi, so > even if the ebuild did know it would be, it wouldn't be there until first > run. > > I'm open to suggestions (and corrections, if I'm wrong, of course). Ah, sorry. I should have read better :)
Maintainers, please confirm. The fix is probably in the tree long time ago.
Ping. Maintainer, is this still a problem?
As far as I can tell, this issue is still a problem. I've reported the issue upstream at https://github.com/xbmc/xbmc/issues/18241
