OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: [ Hackerslab bug_paper ] HP-UX crontab temporary file symboliclink vulnerability
From: Fabio Pietrosanti (naif) (naifINET.IT)
Date: Thu Oct 26 2000 - 06:36:43 CDT

ops,
i could read only file that start with "#" as in the advisor ;))

Tested against also a Slackware 3.0 = Vulnerable .

naif

On Wed, 25 Oct 2000, Kris Kennaway wrote:

> On Wed, Oct 25, 2000 at 12:30:47PM +0200, Fabio Pietrosanti (naif) wrote:
> > Tested also on:
> >
> > FreeBSD 3.3 = Vulnerable
> > FreeBSD 2.2.8 = Vulnerable
>
> Are you sure? Our testing indicates that you can't read an arbitrary
> file, it must conform to cron syntax - basically meaning either all
> lines commented out with a #, or an actual cron job file.
>
> I don't have access to a 2.x machine to test (and in fact the 2.2.x
> series has not been officially supported for some time), but I believe
> 3.5-RELEASE has the above properties I describe.
>
> Kris
>
>