Cobalt RaQ .bash_history Vulnerability
BID:337
Info
Cobalt RaQ .bash_history Vulnerability
| Bugtraq ID: | 337 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 25 1999 12:00AM |
| Updated: | Feb 25 1999 12:00AM |
| Credit: | A security notice was released by cobalt regarding the problem. It was first posted to BugTraq by Patrick Oonk <[email protected]> on February 25, 1999. |
| Vulnerable: |
Cobalt RaQ 1.1 |
| Not Vulnerable: | |
Exploit / POC
Cobalt RaQ .bash_history Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Cobalt RaQ .bash_history Vulnerability
Solution:
Cobalt released a patch for this problem obtainable at ftp://ftp.cobaltnet.com/pub/security.
In addition to installing this patch, one should add the following to /etc/profile:
touch $HISTFILE
chmod 600 $HISTFILE
For added security, one could change the HISTFILE variable itself.
Apache, the installed webserver on Cobalt RaQs can solve the problem as well if the following is added to the apache configuration:
<FilesMatch "^\.">
order allow,deny
deny from all
</FilesMatch>
Solution:
Cobalt released a patch for this problem obtainable at ftp://ftp.cobaltnet.com/pub/security.
In addition to installing this patch, one should add the following to /etc/profile:
touch $HISTFILE
chmod 600 $HISTFILE
For added security, one could change the HISTFILE variable itself.
Apache, the installed webserver on Cobalt RaQs can solve the problem as well if the following is added to the apache configuration:
<FilesMatch "^\.">
order allow,deny
deny from all
</FilesMatch>