Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
I suggest the file be chmodded to 600 during installation. I should note this file gets recreated during start-up. The restricted folder solution is simpler than patching tomcat. If a world readable tomcat-users.xml isn't acceptable, you could try a user not writable folder. That would issue a warning about database persistence but won't override file permissions. By the way, dpkg will keep asking about modifications. I feel tomcat-users.xml should be included as an example, not as an actual configuration file. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
On Sat, Jul 28, 2007 at 11:45:48PM +0200, Marcus Better wrote: David Pashley wrote: On Jul 26, 2007 at 20:43, Michael Koch praised the llamas by saying: On Thu, Jul 26, 2007 at 06:17:28PM +0200, Marcus Better wrote: Yes, but /var/lib/tomcat5.5 is not world-readable: I think this is a grave issue because this file contains world readable passwords, which is clearly a security issue and not minor. The file isn't readable by other users, so it isn't grave. Michael, please confirm if you agree. I agree. I was fooled by my user being in the adm group. Sorry. Cheers, Michael -- .''`. | Michael Koch [EMAIL PROTECTED] : :' : | Free Java Developer http://www.classpath.org `. `' | `-| 1024D/BAC5 4B28 D436 95E6 F2E0 BD11 5923 A008 2763 483B -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
Thanks for looking into it, I absolutely agree that I mistakenly categorized this as grave / security. signature.asc Description: Dies ist ein digital signierter Nachrichtenteil
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
David Pashley wrote: On Jul 26, 2007 at 20:43, Michael Koch praised the llamas by saying: On Thu, Jul 26, 2007 at 06:17:28PM +0200, Marcus Better wrote: Yes, but /var/lib/tomcat5.5 is not world-readable: I think this is a grave issue because this file contains world readable passwords, which is clearly a security issue and not minor. The file isn't readable by other users, so it isn't grave. Michael, please confirm if you agree. Cheers, Marcus signature.asc Description: This is a digitally signed message part.
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
On Thu, Jul 26, 2007 at 06:17:28PM +0200, Marcus Better wrote: severity 434762 minor thanks /var/lib/tomcat5.5/conf/tomcat-users.xml comes with file permissions 644. Yes, but /var/lib/tomcat5.5 is not world-readable: ~$ ls -ld /var/lib/tomcat5.5/conf drwxr-x--- 3 tomcat55 adm 4096 2007-07-26 09:08 /var/lib/tomcat5.5/conf/ Still we could change the file permissions to be on the safe side. I think this is a grave issue because this file contains world readable passwords, which is clearly a security issue and not minor. Cheers, Michael -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
On Jul 26, 2007 at 20:43, Michael Koch praised the llamas by saying: On Thu, Jul 26, 2007 at 06:17:28PM +0200, Marcus Better wrote: severity 434762 minor thanks /var/lib/tomcat5.5/conf/tomcat-users.xml comes with file permissions 644. Yes, but /var/lib/tomcat5.5 is not world-readable: ~$ ls -ld /var/lib/tomcat5.5/conf drwxr-x--- 3 tomcat55 adm 4096 2007-07-26 09:08 /var/lib/tomcat5.5/conf/ Still we could change the file permissions to be on the safe side. I think this is a grave issue because this file contains world readable passwords, which is clearly a security issue and not minor. mojo-jojo david% less /var/lib/tomcat5.5/conf/tomcat-users.xml /var/lib/tomcat5.5/conf/tomcat-users.xml: Permission denied [EMAIL PROTECTED]:~# ls -l /var/lib/tomcat5.5/conf/ -d drwxr-x--- 3 tomcat55 adm 4096 2007-07-17 19:39 /var/lib/tomcat5.5/conf// [EMAIL PROTECTED]:~# ls -l /var/lib/tomcat5.5/conf/ ... -rw-r--r-- 1 tomcat55 nogroup 310 2007-07-17 19:39 tomcat-users.xml ... The file isn't readable by other users, so it isn't grave. -- David Pashley [EMAIL PROTECTED] Nihil curo de ista tua stulta superstitione. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
severity 434762 minor thanks /var/lib/tomcat5.5/conf/tomcat-users.xml comes with file permissions 644. Yes, but /var/lib/tomcat5.5 is not world-readable: ~$ ls -ld /var/lib/tomcat5.5/conf drwxr-x--- 3 tomcat55 adm 4096 2007-07-26 09:08 /var/lib/tomcat5.5/conf/ Still we could change the file permissions to be on the safe side. Marcus signature.asc Description: This is a digitally signed message part.
Bug#434762: tomcat5.5: tomcat-users.xml contains sensitive data, yet it is world-readable
Package: tomcat5.5 Severity: grave Tags: security Justification: user security hole /var/lib/tomcat5.5/conf/tomcat-users.xml comes with file permissions 644. I consider this a security problem, because it's all too easy to add the admin or manager roles while forgetting to change the file permissions to something more restrictive, thus revealing the authentication data used to manage the Tomcat installation to all local users. I suggest the file be chmodded to 600 during installation. -- System Information: Debian Release: etch Architecture: i386 (i686) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
