Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 21 Oct 2017 12:39:34 +0100
From: Simon McVittie <>
Subject: Re: CVE-2017-8805: Unsafe symlinks not filtered in
 Debian mirror script ftpsync

On Fri, 20 Oct 2017 at 23:08:14 +0000, Robert Watson wrote:
> Okay, so a script adds a symlink to /etc/shadow or something else
> confidential. Unless they're root, what good does it do them? They can't
> read it.

In that particular case, it would do an attacker no good. (Unless the
web server that will be serving the mirrored content is running as root,
but don't do that.)

However, there are plenty of files on a system that are readable by the
web server, but should not be readable by random people on the Internet.
If the same web server has password-protected directories (for example
using Apache .htaccess/.htpasswd) then the files with their passwords
usually need to be readable by the web server, but should not be served.

/etc/passwd is another common example: it doesn't contain actual
passwords since shadow passwords became widespread, but having a list
of valid usernames available to the public would make life easier for
an attacker, and should usually be avoided.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.