World-readable permissions in Gentoo init script for webfs
Summary
CVE-2013-0347: The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file. Affects webfs versions < 1.21+ds1-9. Fixed in 1.21+ds1-9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The webfs package is a web server for static content that is commonly used in the Debian ecosystem. It allows users to serve files over HTTP and is often used for simple file sharing or hosting static websites. The Gentoo init script is responsible for managing the webfs service, including starting and stopping it. However, there is a vulnerability in the init script that allows local users to read the webfs log file, which is stored in /var/log/webfsd.log.
Vulnerability Detail
The vulnerability (CVE-2013-0347) arises from the use of world-readable permissions for the webfs log file. This means that any user on the system can read the contents of the log file, potentially exposing sensitive information. Although the impact of this vulnerability is unspecified, it could potentially lead to the disclosure of sensitive data or other security issues.
How To Fix
Minimum fixed version
1.21+ds1-9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade webfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to manually change the permissions of the webfs log file to restrict access. However, this workaround may not be feasible in all scenarios, especially in cases where the file permissions are managed by the package manager or other automated processes.
Conclusion
In conclusion, the Gentoo init script for webfs has a vulnerability that allows local users to read the webfs log file. This vulnerability can potentially lead to the disclosure of sensitive information or other security issues. Users of the webfs package in the Debian ecosystem are advised to update to version 1.21+ds1-9 or apply the necessary permissions fix to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for webfs →
FAQ
The impact of this vulnerability is unspecified, but it could potentially lead to the disclosure of sensitive information or other security issues.
Users of the webfs package in the Debian ecosystem, specifically those using versions 0 to 1.21+ds1-9, are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and the Vulert Playground will analyze it for vulnerabilities.
Yes, a fix for this vulnerability is available in version 1.21+ds1-9 of the webfs package. Users are advised to update their package to the fixed version to mitigate the vulnerability.
A possible workaround for this vulnerability is to manually change the permissions of the webfs log file to restrict access. However, this workaround may not be feasible in all scenarios, especially in cases where the file permissions are managed by the package manager or other automated processes.
Related vulnerabilities
Recent vulnerabilities recorded for webfs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
