FS#33964 - [nginx] CVE-2013-0337 log files world-readable

Attached to Project: Community Packages
Opened by Florian Pritz (bluewind) - Friday, 22 February 2013, 09:17 GMT
Last edited by Bartłomiej Piotrowski (Barthalion) - Saturday, 23 February 2013, 20:48 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Bartłomiej Piotrowski (Barthalion)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

nginx log files are world-readable by default and it looks like our logrotate file doesn't set proper permissions either.

References: http://seclists.org/oss-sec/2013/q1/389

nginx 1.2.7-1
This task depends upon

Closed by  Bartłomiej Piotrowski (Barthalion)
Saturday, 23 February 2013, 20:48 GMT
Reason for closing:  Fixed
Additional comments about closing:  nginx 1.2.7-3
Comment by Dan McGee (toofishes) - Saturday, 23 February 2013, 19:10 GMT
Uh what? 750 marks log files executable, which is surely not correct. You definitely want 640 here.

Loading...