Re: Cobalt root exploit

vermontGATE.NET

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Ken Williams: "ShadowCon October 1999"
• Previous message: The Unicorn: "Re: Patch for InterScan VirusWall for Unix now available"
• Maybe in reply to: Patrick Oonk: "Cobalt root exploit"

+----[ On Thu, Feb 25, at 05:15PM(-0500), xs wrote: ]--------------
| The Fix:
|
| Cobalt has released a security patch in the form of a
| package file that is installed through the web interface.
| The package file changes file permissions for all hidden
| files other than .htaccess in user home directories.
| Package files are available at:
| ftp://ftp.cobaltnet.com/pub/security or on our website
| at: ShellHistoryPatch-1.0.pkg.
+----[ End Quote ]---------------------------

This doesn't sound like a very good permanent fix; dotfiles can spring
into existence at any moment!  You'd have to keep running this fix
over and over to stop new files from being available over the web.

What Cobalt could do to permanently stop dotfiles from getting out
onto the net is to add the following to Apache's conf file:

<FilesMatch "^\.">
order allow,deny
deny from all
</FilesMatch>

This would prevent any file beginning with a dot from being allowed
out through the web.

• Next message: Ken Williams: "ShadowCon October 1999"
• Previous message: The Unicorn: "Re: Patch for InterScan VirusWall for Unix now available"
• Maybe in reply to: Patrick Oonk: "Cobalt root exploit"