From owner-freebsd-stable@freebsd.org Thu Jan 14 17:10:47 2016 Return-Path: Delivered-To: freebsd-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E68A7A822C1 for ; Thu, 14 Jan 2016 17:10:47 +0000 (UTC) (envelope-from fbsd@xtaz.co.uk) Received: from mail.xtaz.uk (tao.xtaz.uk [IPv6:2001:8b0:fe33::10]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7C5CA11AC for ; Thu, 14 Jan 2016 17:10:47 +0000 (UTC) (envelope-from fbsd@xtaz.co.uk) Received: by mail.xtaz.uk (Postfix, from userid 1001) id ED3A420C2204; Thu, 14 Jan 2016 17:10:43 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=xtaz.co.uk; s=mail; t=1452791444; bh=6ZnW6rtczlx/5/3EPeziZ0Ciw5phBMRAzh+w6thZrtk=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=SvmlbB/7Go405JuqxKOs2chyRECaUoV4/HryhckNjivQPLBVjC/8dHbuylW09V1NY JPsgf6EfA0vyP8/gK2/SpEQZJbcgZP0jthxTr73LXBF55p+yJkwDijC9GaKZR5KHqX G1Ry1vmBsaFcVR/dYdUQPWMSy96DrMIG4uX0QYuzedWCmNe5YaLvxbSzQkzqiGFVJ9 lpLauWTDpyPXGnTGbvDmkZkcAQYS9fdVsnCJsVhwgz9Kd7RdokcDervYqFkbRojMWt qkIQLEI88qtOq0WNFf15RBN0zlul60dCPvPeGutvFFXesbOqJiEV671UFMdddXlNXe ywHBgHRuC3lyw== Date: Thu, 14 Jan 2016 17:10:43 +0000 From: Matt Smith To: Andrea Brancatelli Cc: freebsd-stable@freebsd.org Subject: Re: Insecure default bsnmpd.conf permissions (CVE-2015-5677) Message-ID: <20160114171043.GA1282@xtaz.uk> Mail-Followup-To: Matt Smith , Andrea Brancatelli , freebsd-stable@freebsd.org References: <2610214c27a073ba95d275f46e40dda6@schema31.it> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <2610214c27a073ba95d275f46e40dda6@schema31.it> User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jan 2016 17:10:48 -0000 On Jan 14 12:40, Andrea Brancatelli wrote: >Hello everybody. > >I just read the above security advisory. In the solution it says: > >"This vulnerability can be fixed by modifying the permission on >/etc/bsnmpd.conf to owner root:wheel and permission 0600." > >I guess it's a typo and the correct filename is /etc/snmpd.config, >right? There's no /etc/bsnmpd.conf in the default config... > I think you may be right. I don't use bsnmp so I just checked the permissions of the existing file which were 644 and then deleted it and ran mergemaster. mergemaster then reinstalled the missing file and the permissions are now 600. -- Matt