[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171021113934.bk2kdbl66o6anpbr@perpetual.pseudorandom.co.uk>
Date: Sat, 21 Oct 2017 12:39:34 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2017-8805: Unsafe symlinks not filtered in
Debian mirror script ftpsync
On Fri, 20 Oct 2017 at 23:08:14 +0000, Robert Watson wrote:
> Okay, so a script adds a symlink to /etc/shadow or something else
> confidential. Unless they're root, what good does it do them? They can't
> read it.
In that particular case, it would do an attacker no good. (Unless the
web server that will be serving the mirrored content is running as root,
but don't do that.)
However, there are plenty of files on a system that are readable by the
web server, but should not be readable by random people on the Internet.
If the same web server has password-protected directories (for example
using Apache .htaccess/.htpasswd) then the files with their passwords
usually need to be readable by the web server, but should not be served.
/etc/passwd is another common example: it doesn't contain actual
passwords since shadow passwords became widespread, but having a list
of valid usernames available to the public would make life easier for
an attacker, and should usually be avoided.
smcv
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
