Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

mosquitto.db can be read by all [SECURITY] #468

Closed
dalmoz opened this issue Jun 21, 2017 · 3 comments
Closed

mosquitto.db can be read by all [SECURITY] #468

dalmoz opened this issue Jun 21, 2017 · 3 comments
Labels
Component: mosquitto-broker Type: Bug
Milestone
fixes-next

Comments

@dalmoz
Copy link

dalmoz commented Jun 21, 2017

mosquitto.db file is world readable. This is, obviously, leading to the possibility of every local user to read the topic database and values at any given time. (permission rw-r--r--).

A security vulnerability such as this may prove disastorous to sensitive or secret data that can be contained within it.

Mitigation will be scoping the permission scheme to a specific user, that is running the mosquitto service.

Tested on an up-to-date raspberry pi 3 with the latest release of mosquitto.
ralight added a commit that referenced this issue Jun 23, 2017
@ralight
[468] Set persistence file to only be readable by owner.
09cb1b6 
Not implemented on Windows.

Thanks to Moshe Zioni.

Bug: #468
@ralight
Copy link
Contributor

ralight commented Jun 23, 2017

Thanks very much, a good spot. I've fixed this for systems with umask available.

@ralight ralight added this to the fixes-next milestone Jun 23, 2017
@dalmoz
Copy link
Author

dalmoz commented Jun 23, 2017

Thank YOU.
Keep up the good work, man.

@ralight ralight closed this as completed Jun 23, 2017
@dalmoz
Copy link
Author

dalmoz commented Jun 25, 2017

CVE-2017-9868

@lock lock bot locked as resolved and limited conversation to collaborators Aug 8, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Component: mosquitto-broker Type: Bug
Projects
None yet
Milestone
fixes-next
Development

No branches or pull requests
2 participants
@ralight @dalmoz