zhcon May Let Local Users Read Files with Elevated Privileges
|
|
SecurityTracker Alert ID: 1012977
|
|
SecurityTracker URL: http://securitytracker.com/id?1012977
|
|
CVE Reference: CAN-2005-0072
(Links to External Site)
|
Date: Jan 25 2005
|
Impact: Disclosure of system information, Disclosure of user information
|
Version(s): 0.2.3
|
Description: A vulnerability was reported in zhcon. A local user may be able to view files on the target system.
Mandrake reported that a local user may be able to invoke zhcon to access a user-specified configuration file with elevated privileges.
The user can specify an alternate configuration file to view the file.
Erik Sjolund is credited with reporting this flaw.
|
Impact: A local user may be able to view files on the target system with elevated privileges.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: zhcon.sourceforge.net/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 24 Jan 2005 20:22:52 -0500
Subject: [none]
|
Mandrake reported a vulnerability in zhcon. A local user may be able to invoke
zhcon to access a user-controlled configuration file with elevated privileges.
Erik Sjolund is credited with reporting this flaw.
CVE: CAN-2005-0072
|
|
