Re: CVE Request -- logrotate -- nine issues

[Ludwig Nussel <ludwig.nussel () suse de>]

Josh Bressers wrote:
> [...]
> It seems there is now a consensus on this (at least that's how I'm reading
> it). Here is what I plan to do with CVE ids unless someone speaks up.
>
> As best as I can tell, logrotate only needs a CVE id for this:
>
>     8) Issue #8: logrotate: TOCTOU race condition by creation of new files
>        (between opening the file and moment, final permissions have been
>        applied) [information disclosure]

Ack.
 
> We then will need to assign IDs for various broken uses of /var/log (If
> someone has a list of the currently known ones, please pass it along)

AFAICS on openSUSE Factory we have
cobbler
inn
safte-monitor
uucp

service owned log dirs without logrotate:
cups
horde

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)