oss-sec mailing list archives
Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 08 Jan 2013 17:28:32 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/08/2013 12:16 PM, WHK Yan wrote:
The type and range of user defined smf, a co-manager can be created by an administrator setting custom permissions, does not mean it comes by default. Anyway in some groups smf computer security using caution and have had this in our case was a very dangerous.
I apologize but I am having a heck of a time parsing that last sentence. If you want to send it in your native language I can probably get it translated from another Red Hat employee.
2013/1/8 Kurt Seifried <kseifried () redhat com <mailto:kseifried () redhat com>> On 01/08/2013 06:36 AM, WHK Yan wrote:The flaw is not exploitable without privileges. On some occasions there are forums where there are co-admistrators which have privileges to view the error log but not to modify code or at least read the mysql connection.So is a trust/security boundary crossed here? Can you please confirm that the co-admistrator (or anyone) is not supposed to be able to read arbitrary files accessible to the web server, and that this attack does indeed allow that? Thanks. Removing full-disclosure () lists grok org uk <mailto:full-disclosure () lists grok org uk> from CC due to reply spam.
- -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQ7LmwAAoJEBYNRVNeJnmTkWUP/0FeKRu03HvATSfTkox0/DGa WTK51zUZQb4yAoVxiUA4DjEc7wIsZ0ygcwMz9OaxM/tRMrx2d6eiMbEf7SDLfPvD ZsTUrHkQew1pcL7JvSWJ/d6yVkgaMUiCyFZwJLPUL3NSqjOev1C3Nv5dsNfQdmrv yz2gGcFCQFiY4Q7W1PqvJj9AT43zhA4wLZY4Lgs2VaDzsYElWhSBncE4C3GhLAN/ EZzJUV0STtA71+mutQWKl84itukxgdUZ3Hs4yVKTkBt3s3e9G4ziIMCUwirH2y9T V8dn8BRIY8m5pHSLPeDuswnmw1gHOBl4m3++GA1GJvtH8xEYpS68Ca3KA8iiZ6K8 stjbxQ6S4pItpLPCGYfk9CiIfH5aeW2eYvv+pQzvX+WgRRoVHXbnP0zx6+RvvEIb 8cvnmMXHnFg6Q2/pZuEMCyRPRcqrbjjyPCy0COn6LlskZw5jq1xfv/GcbN0IBYM0 T7pepu3H0ORcutaMXeW8o813LQGnxV522N84+L3E1iP3hn93WihPZ4pr56P0QChf ZdL+L9pzeGdBOBXyA4QLyf7fkcbegCc03u9rcfjFxDEmKwsJbYlIL9ayOnWG7h4A 6mCgVXQhOrZmvN7gKOipfJ6kO1q2n6p9R8PmVvWoRaAhjKLsKH86gb6dB8AZ8ePa vYw2OJFl9M8r5NcfQPlD =1W7j -----END PGP SIGNATURE-----
Current thread:
- Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 Carlos Alberto Lopez Perez (Jan 08)
- Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 WHK Yan (Jan 08)
- Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 Kurt Seifried (Jan 08)
- Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 WHK Yan (Jan 08)
- Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 Kurt Seifried (Jan 08)
- Message not available
- Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 Carlos Alberto Lopez Perez (Jan 11)
- Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 Kurt Seifried (Jan 16)
- Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 Kurt Seifried (Jan 08)
- Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 WHK Yan (Jan 08)