access.log is owned by root and has write permissions to anyone

[Julien Desfossez]

Binary package hint: ntop

On hardy 8.04 LTS with ntop 3:3.2-10.1, the file /var/log/ntop/access.log has write permissions to anyone.

ls -lh /var/log/ntop/access.log
-rw-rw-rw- 1 root root 0 2009-02-04 11:53 /var/log/ntop/access.log

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug.

Email sent to upstream and vendor-sec, requesting a CRD of 2009-02-25 00:00 UTC. Unless otherwise noted, the bug can be made public after this date.

[Jamie Strandboge (jdstrand)]

Upstream and vendor-sec did not request a different CRD. Marking public.

[Vincent (vincent-redhat-bugs)]

It was reported to Ubuntu that ntop creates the access log world-writable when the --access-log-file option is used.

This option is not used in Fedora or Red Hat by default and is not noted in the configuration file. It is, however, noted in the ntop manpage. It would require the root user to add this option to the configuration in order for this file to be created.

This is a low severity issue.

A possible fix would be the following patch:

--- http.c.org 2009-03-16 16:28:10.000000000 -0700
+++ http.c 2009-03-16 16:27:55.000000000 -0700
@@ -1298,6 +1298,7 @@ void printHTMLtrailer(void) {
 void initAccessLog(void) {

   if(myGlobals.runningPref.accessLogFile) {
+ umask(0137);
     myGlobals.accessLogFd = fopen(myGlobals.runningPref.accessLogFile, "a");
     if(myGlobals.accessLogFd == NULL) {
       traceEvent(CONST_TRACE_ERROR, "Unable to create file %s. Access log is disabled.",

[Vincent (vincent-redhat-bugs)]

Forgot to note the Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/ntop/+bug/325393

[Fedora (fedora-redhat-bugs)]

ntop-3.3.8-3.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/ntop-3.3.8-3.fc10

[Rakesh (rakesh-redhat-bugs)]

Fixed in rawhide and submitted an update to bodhi. Will take some time to reach updates.

[Tomas (tomas-redhat-bugs)]

Please do not close 'Security Response' bugs that may affect other products as well. Thank you!

[Andreas Olsson (andol)]

This is by the way still true in the Jaunty version (ntop 3.3-11ubuntu1)

[Andreas Olsson (andol)]

Fedora seems to fix this by setting a hard coded umask into the source code. Is this an approach we want to take?

It looks as if ntop only insists on creating global writable logs if the option -d (--daemon) is used. Runnong non-daemonized it obeys umask settings just fine.

I experienced the exact same behavior while downloading the latest version from SVN.

@Jamie: While you were in contact with upstream, did they give you a ticket number for this issue? I can't seem to find any in their Trac.

[Jamie Strandboge (jdstrand)]

Andreas: upstream never responded. If you or someone else is preparing debdiffs for Ubuntu, it would be great if upstream and Debian were sent the patch as well.

[Andreas Olsson (andol)]

Reported this upstream. Couldn't find any way to get Launchpad to link against ntop using "Also affects project".

http://www.ntop.org/trac/ticket/75

[Rakesh (rakesh-redhat-bugs)]

This has been pushed into stable. Why not close it now ?? Which other products it effects ?? I am confused.

[Fedora (fedora-redhat-bugs)]

ntop-3.3.8-3.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.

[Vincent (vincent-redhat-bugs)]

Hi, Rakesh. Fedora is not the only product shipping this (EPEL5 and HPC also ship it).

[Tomas (tomas-redhat-bugs)]

Upstream bug:
  http://www.ntop.org/trac/ticket/75

Upstream commit:
  http://www.ntop.org/trac/changeset/3748/trunk

[Ludovico Cavedon (cavedon)]

Looks like this bug is no longer present in the latest version in Ubuntu.

Thanks for taking the time to report the issue.