Date: Sat, 21 Oct 2017 12:39:34 +0100 From: Simon McVittie <smcv@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync On Fri, 20 Oct 2017 at 23:08:14 +0000, Robert Watson wrote: > Okay, so a script adds a symlink to /etc/shadow or something else > confidential. Unless they're root, what good does it do them? They can't > read it. In that particular case, it would do an attacker no good. (Unless the web server that will be serving the mirrored content is running as root, but don't do that.) However, there are plenty of files on a system that are readable by the web server, but should not be readable by random people on the Internet. If the same web server has password-protected directories (for example using Apache .htaccess/.htpasswd) then the files with their passwords usually need to be readable by the web server, but should not be served. /etc/passwd is another common example: it doesn't contain actual passwords since shadow passwords became widespread, but having a list of valid usernames available to the public would make life easier for an attacker, and should usually be avoided. smcv
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.