Full Disclosure mailing list archives
Re: Leveraging pam_env to steal DSA keys
From: paul.szabo () sydney edu au
Date: Tue, 31 May 2011 22:19:42 +1000
Peter van Dijk <peter () 7bits nl> wrote:
lilo.conf commonly has whitespace around '=', pam_env does not tolerate that
Not mine! I specifically grep-ed for '[^ ]=[^ ]' in files in /etc which are unreadable to mortals.
bind configs don't even use '=' and are often indented, pam_env does not tolerate indents
My bind configs have something like secret "abcdef=="; (seems base64-encoded something). I did not realize that leading blanks were also an "issue".
If I understand correctly, Debian (and, I presume, Ubuntu) put this bug on low priority precisely because there were very few practical applications that they knew of.
So far, my lilo.conf is a worry (for me). Thanks, Paul Paul Szabo psz () maths usyd edu au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Leveraging pam_env to steal DSA keys Peter van Dijk (May 30)
- Re: Leveraging pam_env to steal DSA keys paul . szabo (May 30)
- Re: Leveraging pam_env to steal DSA keys Peter van Dijk (May 30)
- Re: Leveraging pam_env to steal DSA keys paul . szabo (May 31)
- Re: Leveraging pam_env to steal DSA keys Peter van Dijk (May 30)
- Re: Leveraging pam_env to steal DSA keys paul . szabo (May 30)