We've come across a bug with syllabus item attachments not adopting the access permissions set for the syllabus item. Here's the scenario we're seeing,
In a site that is configured to display in the public sites directory...
1. Create a new syllabus item and set it to "Public" access.
2. Enter some text in the editor.
3. Attach a file.
4. Post the syllabus.
5. Log out of your session, then access the site listing in Sites directory to view the syllabus and click on the attachment.
The user is prompted for authentication, which means anonymous users can't view the attached file.