Akfingerd File Disclosure Vulnerability
BID:6325
Info
Akfingerd File Disclosure Vulnerability
| Bugtraq ID: | 6325 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 05 2002 12:00AM |
| Updated: | Dec 05 2002 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Gianni Tedesco <[email protected]>. |
| Vulnerable: |
akfingerd akfingerd 0.5 |
| Not Vulnerable: | |
Discussion
Akfingerd File Disclosure Vulnerability
A vulnerability has been discovered in akfingerd that may allow attackers to view the contents of potentially sensitive files. This issue is due to the akfinger daemon not dropping supplementary group privileges, as well as insufficient sanity checks of the '.plan' file which is located in a user's home directory.
By symlinking a user's '.plan' file to an arbitrary system resource it is possible to cause akfingerd to disclose the symlinked file's contents.
It should be noted that this vulnerability was discovered in akfingerd 0.5. It is not yet known whether earlier versions are affected.
A vulnerability has been discovered in akfingerd that may allow attackers to view the contents of potentially sensitive files. This issue is due to the akfinger daemon not dropping supplementary group privileges, as well as insufficient sanity checks of the '.plan' file which is located in a user's home directory.
By symlinking a user's '.plan' file to an arbitrary system resource it is possible to cause akfingerd to disclose the symlinked file's contents.
It should be noted that this vulnerability was discovered in akfingerd 0.5. It is not yet known whether earlier versions are affected.
Exploit / POC
Akfingerd File Disclosure Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Akfingerd File Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Akfingerd File Disclosure Vulnerability
References:
References:
- Akfingerd Product Page (www.synflood.at)
- Multiple vulnerabilities in akfingerd (Gianni Tedesco