Your message dated Fri, 13 Mar 2015 22:24:41 +0000 with message-id <[email protected]> and subject line Bug#780289: Removed package(s) from unstable has caused the Debian Bug report #637685, regarding creates database accessible to anyone from localhost to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 637685: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637685 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: zoneminder Version: 1.24.4-1 Severity: minor Tags: security The debian package creates a database for zoneminder accessible by anyone with ssh/console access to the machine (or, well, by anyone that can use the server as vpn / tunnel endpoint), given that user and pass is always zmuser and zmpass, and the only restriction enforced is for the connection to come from localhost. It's trivial to change the user and password, and it's usually not a big deal, given that it's rare to have a camera server with shared access. But: - README.Debian / dialogs / ... should mention changing the password. - postinst could easily generate a random password rather than always use zmpass. - /etc/zm/zm.conf should not be world-readable. -- System Information: Debian Release: wheezy/sid APT prefers testing APT policy: (995, 'testing'), (500, 'oldstable'), (500, 'unstable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.39-2-686-pae (SMP w/2 CPU cores) Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/dash
--- End Message ---
--- Begin Message ---Version: 1.26.5-3+rm Dear submitter, as the package zoneminder has just been removed from the Debian archive unstable we hereby close the associated bug reports. We are sorry that we couldn't deal with your issue properly. For details on the removal, please see https://bugs.debian.org/780289 The version of this package that was in Debian prior to this removal can still be found using http://snapshot.debian.org/. This message was generated automatically; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]. Debian distribution maintenance software pp. Scott Kitterman (the ftpmaster behind the curtain)
--- End Message ---
