Bug 458892 – <www-servers/webfs-1.21-r3: world-readable logdir (CVE-2013-0347)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-02-23 19:01:40 UTC]

As reported by me on oss-security at $URL, webfs, at least on gentoo, has a world-redable log/logdir:

# ls /var/log/webfsd.log -la
-rw-r--r-- 1 root root 0 Feb 22 14:02 /var/log/webfsd.log

[Comment 1 Zac Medico 2013-06-14 23:24:56 UTC]

This is fixed in webfs-1.21-r3 with this patch:

--- ./webfsd.c
+++ ./webfsd.c
@@ -918,8 +918,11 @@
 	} else {
 	    if (NULL == (logfh = fopen(logfile,"a")))
 		xperror(LOG_WARNING,"open access log",NULL);
-	    else
+	    else {
 		close_on_exec(fileno(logfh));
+		if (0 != chmod(logfile,S_IRUSR|S_IWUSR))
+		    xperror(LOG_WARNING,"chmod access log",NULL);
+	    }
 	}
     }

[Comment 2 Zac Medico 2013-06-29 20:59:07 UTC]

Arch teams, stabilize www-servers/webfs-1.21-r3 please.

[Comment 3 Agostino Sarubbo 2013-06-30 12:38:34 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2013-06-30 12:43:36 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2013-06-30 21:10:12 UTC]

ppc stable

[Comment 6 Chris Reffett (RETIRED) 2013-08-23 15:05:41 UTC]

GLSA vote: no

[Comment 7 Sergey Popov 2013-09-04 05:42:46 UTC]

GLSA vote: no

Closing as noglsa