bugtraq - Re: Nokia IPSO Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 24 Apr 2003 13:34:49 -0500
From: Damieon Stark <visigoth@...uritycentric.com>
To: Jorge Merlino <jmerlino@...ynet.com.uy>
Subject: Re: Nokia IPSO Vulnerability

On Thu, Apr 24, 2003 at 01:32:50PM -0300, Jorge Merlino wrote:
> I don't think that is a vulnerability.
> The file /etc/master.passwd has read access for all users. Monitor can also
> read it in a ssh session.
> I you try that URL in a file with, let's say, 660 permissions you get a
> blank page.

Ummm...  What am I missing here?  Does it seem _crazy_ to anybody else that
the permissions on the file containing some of the most sensitive information
on the system would have read access to all users?  This is clearly NOT
the default on any of the BSD systems (including the one from which IPSO is
derived) that I am aware of.

Can anybody else confirm the permissions required to read the file?  Can
anybody else confirm that the /etc/master.passwd file is a+r?

I would have to call this a vulnerability either way....

-visigoth