Package: freeradius
Severity: grave
Tags: security
Justification: user security hole
Dear Maintainer,
first of all, I already shared the following information with the debian
security team and they asked me to file this as a bug report: "I'm not why the
Debian packaging diverges, can you please file a bug against freeradius to have
the discussion with the maintainers in public?", Moritz Muehlenhoff from debian
security team.
Issue:
It seems, that sensitive information (for example stored in
/etc/freeradius/users) can be read by every system user ("others"). After
asking the freeradius team I was told, that the /etc/freeradius directory has
permissions 750 on their install (see Makefile). On my standard ubuntu/debian
package installation there is another/divergent permission set, which allows
every system user to access the freeradius directory (and therefore also some
files like /etc/freeradius/users which can contain sensitive information).
I assume the debian freeradius package should be adapted, so that access to the
whole /etc/freeradius directory is restricted, as intended by the freeradius
team.
Best regards
Simon Boldinger
-- System Information:
Debian Release: stretch/sid
APT prefers artful-updates
APT policy: (500, 'artful-updates'), (500, 'artful-security'), (500,
'artful'), (100, 'artful-backports')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.13.0-32-generic (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages freeradius depends on:
pn freeradius-common <none>
pn freeradius-config <none>
ii libc6 2.26-0ubuntu2.1
pn libct4 <none>
pn libfreeradius3 <none>
ii libgdbm3 1.8.3-14
ii libpam0g 1.1.8-3.2ubuntu3
ii libperl5.26 5.26.0-8ubuntu1
ii libpython2.7 2.7.14-2ubuntu2
ii libreadline7 7.0-0ubuntu2
ii libsqlite3-0 3.19.3-3
ii libssl1.0.0 1.0.2g-1ubuntu13.3
ii libtalloc2 2.1.9-2ubuntu1
ii libwbclient0 2:4.6.7+dfsg-1ubuntu3.1
ii lsb-base 9.20160110ubuntu5
Versions of packages freeradius recommends:
pn freeradius-utils <none>
Versions of packages freeradius suggests:
pn freeradius-krb5 <none>
pn freeradius-ldap <none>
pn freeradius-mysql <none>
pn freeradius-postgresql <none>
pn snmp <none>
