zhcon May Let Local Users Read Files with Elevated Privileges
|
|
SecurityTracker Alert ID: 1012977 |
|
SecurityTracker URL: http://securitytracker.com/id/1012977
|
|
CVE Reference:
CAN-2005-0072
(Links to External Site)
|
Date: Jan 25 2005
|
Impact:
Disclosure of system information, Disclosure of user information
|
|
Version(s): 0.2.3
|
Description:
A vulnerability was reported in zhcon. A local user may be able to view files on the target system.
Mandrake reported that a local user may be able to invoke zhcon to access a user-specified configuration file with elevated privileges. The user can specify an alternate configuration file to view the file.
Erik Sjolund is credited with reporting this flaw.
|
Impact:
A local user may be able to view files on the target system with elevated privileges.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: zhcon.sourceforge.net/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 24 Jan 2005 20:22:52 -0500
Subject: [none]
|
Mandrake reported a vulnerability in zhcon. A local user may be able to invoke
zhcon to access a user-controlled configuration file with elevated privileges.
Erik Sjolund is credited with reporting this flaw.
CVE: CAN-2005-0072
|
|
