Re: [cobalt-users] userList.php possible exploit

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Mon, 5 May 2003, Tom Honec wrote:
>
> I would like to bring to your attention a recent exploit which we found
> on some Cobalt RaQ 550s.  I would like your assistance in verifying this
> possible exploit.
>
> Possible Exploit:
> An authenicated Site Administrator is able to view all users on the
> local system.
>
> Steps to Duplicate:
> 1.  Create a site on the RaQ 550
> 2.  Assign a user with Site Administrator privledge
> 3.  Access the following URL:
> http://www.domain.com:81/base/user/userList.php?group=
> 4.  Login with the newly created Site Administrator account
> 5.  You should see all users on the server
>
> My question to User Group, is has this been corrected by Sun, can it be
> duplicated?
>

  I get a page not found.

Gerald
--
http://frontstreetnetworks.com | http://store.raqware.com
  Front Street Networks LLC, 229 Front Street, Ste.#C
  New Haven, CT 06513-3203 | phone: +1-203-785-0699