mumble-server creates world readable config file

Already fixed in natty (mumble 1.2.2-6).

Uploaded a fix to lucid-proposed and maverick-proposed, waiting for approval.

IMO this borders on being a security vulnerability. The patch of course is good, but I'm hesitant on whether or not this should be handled as a USN so that affected administrators can be aware of potential sensitive information leakage.

After talking it over with Kees Cook, I think it's best to handle this bug as a security update and go through the Ubuntu Security Team rather than SRU.

Alright, attached is a debdiff targeting maverick-security.
If this one is fine, I'll prepare packages for the other series.
I have tested that it correctly sets the permissions for new installs and upgrades.

Patrick,

Definitely it's not an earth-shattering vulnerability, but the Ubuntu process for USNs isn't any more difficult to go through than the SRU process (need the debdiff to be tested and commented as tested on the bug report).

John

On Jan 19, 2011, at 1:31 PM, Patrick Matthäi wrote:

> Am 19.01.2011 18:58, schrieb John Dong:
>> After talking it over with Kees Cook, I think it's best to handle this
>> bug as a security update and go through the Ubuntu Security Team rather
>> than SRU.
>>
>
> Hello,
>
> I already asked the Debian Security Team how I should handle this. In
> their opinion it is nothing for a DSA, but it is fixed with our next
> point release.
>
> --
> /*
> Mit freundlichem Gruß / With kind regards,
> Patrick Matthäi
> GNU/Linux Debian Developer
>
> E-Mail: <email address hidden>
> <email address hidden>
>
> Comment:
> Always if we think we are right,
> we were maybe wrong.
> */
>

Thanks for the debdiff!

It is possible that /etc/mumble-server.ini will not be present on upgrades, in which case postinst would fail. Please verify that the file exists by doing something like this instead:

if [ -f /etc/mumble-server.ini ]; then
    chmod 0640 /etc/mumble-server.ini || true
    chown root:mumble-server /etc/mumble-server.ini || true
fi

Unsubscribing ubuntu-security-sponsors. Please resubscribe ubuntu-security-sponsors and set the status to 'NEW' when the changes are complete. Thanks!

I've fixed the debdiff for maverick.
The "|| true" error catch shouldn't be necessary.

debdiff for lucid

debdiff for karmic

debdiff for hardy

ACK to hardy-maverick.

Uploaded hardy-maverick to the security PPA. Thanks for the patches!

This bug was fixed in the package mumble - 1.2.2-4ubuntu0.1

---------------
mumble (1.2.2-4ubuntu0.1) maverick-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 12:22:57 +0100

This bug was fixed in the package mumble - 1.2.2-1ubuntu1.1

---------------
mumble (1.2.2-1ubuntu1.1) lucid-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 12:56:28 +0100

This bug was fixed in the package mumble - 1.1.8-3ubuntu0.1

---------------
mumble (1.1.8-3ubuntu0.1) karmic-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 13:02:46 +0100

This bug was fixed in the package mumble - 1.1.3-0ubuntu2.1

---------------
mumble (1.1.3-0ubuntu2.1) hardy-security; urgency=low

  * SECURITY UPDATE: /etc/mumble-server.ini is world readable. (LP: #704674)
    - debian/mumble-server.postinst: Set permissions of mumble-server.ini to
      0640 and the owner to root:mumble-server.
 -- Felix Geyer <email address hidden> Thu, 20 Jan 2011 13:02:50 +0100