Xbiff 2 Insecure Permissions Information Disclosure Vulnerability

Bugtraq ID:	19762
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 30 2006 12:00AM
Updated:	Sep 01 2006 11:13PM
Credit:	Thomas Wolff discovered this issue.
Vulnerable:	Xbiff 2 Xbiff 2 1.9
Not Vulnerable:

Xbiff 2 Insecure Permissions Information Disclosure Vulnerability

Xbiff 2 is prone to an information-disclosure vulnerability due to insecure file permissions.

A successful attack can allow a local attacker to retrieve credentials and potentially gain access to a user's mail. This could lead to other attacks as well.

Xbiff 2 version 1.9 for Linux is reportedly vulnerable; other versions may be affected as well.

Xbiff 2 Insecure Permissions Information Disclosure Vulnerability

Attackers can exploit this issue using standard utilities provided with the operating system.

Xbiff 2 Insecure Permissions Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Xbiff 2 Insecure Permissions Information Disclosure Vulnerability

References:

• Xbiff 2 Home Page (Xbiff 2)