Re: [cobalt-users] MAJOR BUG, Browse any directory view any file

[Kevin Bonner <keb@xxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 29 May 2003 15:47, Erica Douglass wrote:
> The deal is that it doesn't change permissions for anything under
> /home/sites, just the /home/sites directory itself. If you want to cd
> /home/sites/www.simpli.biz/web as admin, you still can... you just have
> to know that it's /home/sites/www.simpli.biz (i.e. you can't see a list
> of the sites, and you can't tab-complete them as anyone but root.)
>
> This closes up a major security hole with very little effort.
>
> Erica Douglass
> Lead Web Developer
> Simpli, Inc.

Hmm...and what about 'cd /home/sites/site1', or whatever the layout may be 
depending on the type of Cobalt product you're dealing with?  If a person 
knows the actual directory layout of a Cobalt (probably not hard to find), 
it's kind of difficult to say that you're actually closing up a "major 
security hole" (how is this a hole?).

Some other places where you might find the list of sites that are on the box:
/home/cmu/
/home/.cobalt/report/
/usr/local/majordomo/
/usr/admserv/html/.cobalt/siteManage/
/etc/httpd/conf/httpd.conf

This is mostly from a 'locate' for a particular site on a RaQ4.  I'm sure 
there are numerous other places where the list of sites are accessible, so 
unless you track them down and fix them all, the "security hole" still 
exists.

Kevin Bonner
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+1nJw/9i/ml3OBYMRAjoTAJ9bcuwdWI/nesowOmJbbp+ki8XxwwCfWJ3m
2S7dkLMxrX48kJWpbWBGxGE=
=g8oP
-----END PGP SIGNATURE-----