Bug#684075: munin: insecure state file handling, munin->root

2012-08-09 Thread Kenyon Ralph
On 2012-08-09T09:29:06+0200, Helmut Grohne wrote: > Big list. Now let's look at the second condition. Surely the plugin will > somehow have to reference /var/lib/munin/plugin-state. Since plugin.sh > does not give that reference and there is no other library for writing > plugins they will somehow

Bug#684075: munin: insecure state file handling, munin->root

2012-08-09 Thread Helmut Grohne
I investigated whether just fixing the smart_ plugin would be enough of a workaround for stable. We only have a finite amount of plugins that can instantiate this vulnerability. Just how many do? Basically we are interested in those plugins that run with elevated privileges and use state files. The