SmoothWall Configuration Files World Read Vulnerability

Bugtraq ID:	3881
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 15 2002 12:00AM
Updated:	Jan 15 2002 12:00AM
Credit:	This vulnerability was originally discussed in a c'T Magazine article by Juergen Schmidt <[email protected]>.
Vulnerable:	SmoothWall SmoothWall 0.9.9 SE SmoothWall SmoothWall 0.9.9
Not Vulnerable:

SmoothWall Configuration Files World Read Vulnerability

SmoothWall is a freely available, open source Linux firewall solution. It is maintained and distributed by the SmoothWall Project.

SmoothWall uses a loose permission set in their firewall implementation. While this is not inherently dangerous as firewall systems are not designed as multi-user, an unauthorized user gaining access to the system via exploitation of an unprivileged process may be able to gain access to sensitive information on the system. The /var/smoothwall directory containing the configuration files has permissions set to 0700, with the owner and group membership set to nobody.

SmoothWall Configuration Files World Read Vulnerability

References:

• c'T Magazine - More Fiction than Fact? (SmoothWall)
  
• Response on the article (Heise)
  
• Response to c't Article (SmoothWall)
  
• Security Hole in SmoothWall (Heise)
  
• SmoothWall News Page (SmoothWall)
  
• The Firewall from a CD (Heise)
  
• Trench Warfare (SmoothWall)