
oss-sec mailing list archives
Tracking down a lost CVE request (MITRE)
From: Michael Orlitzky <michael () orlitzky com>
Date: Tue, 06 Aug 2024 11:10:06 -0400
Couldn't think of a better place to ask this. I requested a CVE back in March for an issue with the installed permissions in Nagios's NDOUtils. I think the request ID was #1620090. I received a confirmation, but never got a follow-up response. I've since replied to the CVE-Request@ address, and have filled out the form with an "other" request asking for an update, but haven't heard back. New requests are obviously still being issued -- is there some way to find out what happened to this one? FWIW: Before NDOUtils-2.1.4 (released five days ago), the upstream Makefile would install the "ndo2db" daemon executable with the same owner/group that it is intended eventually to run as (namely: "nagios"). But the daemon is designed to be started as root and drop privileges to that user. If the "nagios" user can edit a binary that root will run, he can gain root privileges.
Current thread:
- Tracking down a lost CVE request (MITRE) Michael Orlitzky (Aug 06)
- Re: Tracking down a lost CVE request (MITRE) Mark Esler (Aug 14)
- Re: Tracking down a lost CVE request (MITRE) Michael Orlitzky (Aug 14)
- Re: Tracking down a lost CVE request (MITRE) Mark Esler (Aug 14)