mumble-server creates world readable config file

[Felix Geyer]

Binary package hint: mumble

mumble-server creates the config file /etc/mumble-server.ini
and doesn't change the permissions so it is world readable (0644).

The config file contains sensitive information like the server and sql password.

[Felix Geyer (debfx)]

Already fixed in natty (mumble 1.2.2-6).

[Felix Geyer (debfx)]

Uploaded a fix to lucid-proposed and maverick-proposed, waiting for approval.

[John Dong (jdong)]

IMO this borders on being a security vulnerability. The patch of course is good, but I'm hesitant on whether or not this should be handled as a USN so that affected administrators can be aware of potential sensitive information leakage.

[John Dong (jdong)]

After talking it over with Kees Cook, I think it's best to handle this bug as a security update and go through the Ubuntu Security Team rather than SRU.

[Felix Geyer (debfx)]

Alright, attached is a debdiff targeting maverick-security.
If this one is fine, I'll prepare packages for the other series.
I have tested that it correctly sets the permissions for new installs and upgrades.

[John Dong (jdong)]

Patrick,

Definitely it's not an earth-shattering vulnerability, but the Ubuntu process for USNs isn't any more difficult to go through than the SRU process (need the debdiff to be tested and commented as tested on the bug report).

John

On Jan 19, 2011, at 1:31 PM, Patrick Matthäi wrote:

> Am 19.01.2011 18:58, schrieb John Dong:
>> After talking it over with Kees Cook, I think it's best to handle this
>> bug as a security update and go through the Ubuntu Security Team rather
>> than SRU.
>>
>
> Hello,
>
> I already asked the Debian Security Team how I should handle this. In
> their opinion it is nothing for a DSA, but it is fixed with our next
> point release.
>
> --
> /*
> Mit freundlichem Gruß / With kind regards,
> Patrick Matthäi
> GNU/Linux Debian Developer
>
> E-Mail: <email address hidden>
> <email address hidden>
>
> Comment:
> Always if we think we are right,
> we were maybe wrong.
> */
>

[Jamie Strandboge (jdstrand)]

Thanks for the debdiff!

It is possible that /etc/mumble-server.ini will not be present on upgrades, in which case postinst would fail. Please verify that the file exists by doing something like this instead:

if [ -f /etc/mumble-server.ini ]; then
    chmod 0640 /etc/mumble-server.ini || true
    chown root:mumble-server /etc/mumble-server.ini || true
fi

[Jamie Strandboge (jdstrand)]

Unsubscribing ubuntu-security-sponsors. Please resubscribe ubuntu-security-sponsors and set the status to 'NEW' when the changes are complete. Thanks!

[Felix Geyer (debfx)]

I've fixed the debdiff for maverick.
The "|| true" error catch shouldn't be necessary.

[Felix Geyer (debfx)]

debdiff for lucid

[Felix Geyer (debfx)]

debdiff for karmic

[Felix Geyer (debfx)]

debdiff for hardy

[Jamie Strandboge (jdstrand)]

ACK to hardy-maverick.

[Jamie Strandboge (jdstrand)]

Uploaded hardy-maverick to the security PPA. Thanks for the patches!

[Launchpad Janitor (janitor)]

This bug was fixed in the package mumble - 1.2.2-4ubuntu0.1

---------------
mumble (1.2.2-4ubuntu0.1) maverick-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 12:22:57 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package mumble - 1.2.2-1ubuntu1.1

---------------
mumble (1.2.2-1ubuntu1.1) lucid-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 12:56:28 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package mumble - 1.1.8-3ubuntu0.1

---------------
mumble (1.1.8-3ubuntu0.1) karmic-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 13:02:46 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package mumble - 1.1.3-0ubuntu2.1

---------------
mumble (1.1.3-0ubuntu2.1) hardy-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 13:02:50 +0100