Home page logo

oss-sec logo oss-sec mailing list archives

CVE Request (minor) -- Two Munin graphing framework flaws
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Mon, 16 Apr 2012 15:54:21 +0200

Hello Kurt, Steve, vendors,

  the following three problems has been recently reported against Munin:
  [1] Insecure temp file use in the qmailscan plug-in:


  [2] Possibility to inject escape sequences into Munin's log file:


  [3] Remote users can fill /tmp filesystem:
      Red Hat would not consider this to be a security flaw =>
      no RH BTS entry.

      Original report:

For the first two -- though both of them having minor security impact,
under suitable circumstances they could lead to trust boundary crossing =>
under our opinion they should get a (CVE-2012-*) identifiers.

For the third issue -- we wouldn't consider it to be a security
flaw. Just as something, which on improperly configured machine
could allow to fill in /tmp filesystem (just another way how to
do it, when the particular service isn't properly configured).

Could you allocate CVE ids for the first two issues?

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]