Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync

[Simon McVittie <smcv () debian org>]

On Fri, 20 Oct 2017 at 23:08:14 +0000, Robert Watson wrote:
> Okay, so a script adds a symlink to /etc/shadow or something else
> confidential. Unless they're root, what good does it do them? They can't
> read it.

In that particular case, it would do an attacker no good. (Unless the
web server that will be serving the mirrored content is running as root,
but don't do that.)

However, there are plenty of files on a system that are readable by the
web server, but should not be readable by random people on the Internet.
If the same web server has password-protected directories (for example
using Apache .htaccess/.htpasswd) then the files with their passwords
usually need to be readable by the web server, but should not be served.

/etc/passwd is another common example: it doesn't contain actual
passwords since shadow passwords became widespread, but having a list
of valid usernames available to the public would make life easier for
an attacker, and should usually be avoided.

    smcv