Bugtraq mailing list archives
Re: Nokia IPSO Vulnerability
From: Valdis.Kletnieks () vt edu
Date: Thu, 24 Apr 2003 13:43:21 -0400
On Thu, 24 Apr 2003 13:32:50 -0300, Jorge Merlino <jmerlino () easynet com uy> said:
I don't think that is a vulnerability. The file /etc/master.passwd has read access for all users. Monitor can also read it in a ssh session.
1) It being readable to all users *authorized to use the system* is different from it being readable to any bozo on the entire Internet. 2) /etc/master.password is used as a *Proof of Concept*. Feel free to substitute any other file that might be more damaging to have. Hmm.. it might be nice to snarf a copy of /etc/inetd.conf, see what's enabled.. or maybe I want to grab a copy of.....
Attachment:
_bin
Description:
Current thread:
- Nokia IPSO Vulnerability Jonas Eriksson (Apr 24)
- RE: Nokia IPSO Vulnerability Jorge Merlino (Apr 24)
- Re: Nokia IPSO Vulnerability Damieon Stark (Apr 24)
- Re: Nokia IPSO Vulnerability Shawn Duffy (Apr 24)
- Re: Nokia IPSO Vulnerability Valdis . Kletnieks (Apr 24)
- RE: Nokia IPSO Vulnerability Jorge Merlino (Apr 24)
- Re: Nokia IPSO Vulnerability Damieon Stark (Apr 24)
- <Possible follow-ups>
- RE: Nokia IPSO Vulnerability Miller, Rick (Apr 24)
- RE: Nokia IPSO Vulnerability Iain.King (Apr 24)
- RE: Nokia IPSO Vulnerability Jorge Merlino (Apr 24)