Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 21 Oct 2017 15:57:52 -0400
From: Robert Watson <>
Subject: Re: CVE-2017-8805: Unsafe symlinks not filtered in
 Debian mirror script ftpsync

Thank You for tolerating my questions. I've read the wikis and pages
you've suggested, and am attempting to format this reply as required.
Please advise if anything is still wrong.

On Sat, Oct 21, 2017 at 6:58 AM, Solar Designer <> wrote:
> On Fri, Oct 20, 2017 at 11:08:14PM +0000, Robert Watson wrote:
> > Okay, so a script adds a symlink to /etc/shadow or something else
> > confidential. Unless they're root, what good does it do them? They can't
> > read it.
> I think this specific question had already been addressed by Ben in:
> ...

I didn't see how revealing configuration details was anything more
than "security by obscurity" but that's not a discussion for this
forum. Mea Culpa.

> While we're at it, I also recommend that you avoid top-posting and
> over-quoting.  Here's how to format your messages better:

Believe it or not, this is first occasion using the "Plain text"
feature in the browser version of Gmail and editing the included text.
Was using Google Inbox on a tablet before. I write programs. Really
pretty naive when it comes to skillfully using software.

Will use this in the future.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.