[cobalt-users] Re: Exploit in Security 3.0.1-6650

[Rod Todd <rodd_todd_1999@xxxxxxxxx>]

Does this affect Qube2's and Raq2's, and how do we
disable NSF to stop NSF attacks.

Also, off subject, found an exploit that if anyone
typed www.qube2.com:81/.cobalt/groupList/ , all the
current group names, user names, all account info, and
all other user restricted Cobalt GUI templates HTML
can be seen.  For the list of users, it is
.../.cobalt/AddUser/, and so on for each GUI HTML
page.  We did  a Chmod go-rwx to limit the files to
only be rwx by User, but still anyone from a browser
who types in the URLs can see all the groups and
users, and can even attempt to change the default size
of groups, though it does not actually take effect.
Any clues why the Chmod command is not working (are we
doing something wrong?), and is there any way to patch
this up?
Cheers 

__________________________________________________
Do You Yahoo!?
Send instant messages & get email alerts with Yahoo! Messenger.
http://im.yahoo.com/