1) If a user enters the right password in the voyager login window she is *authenticated to use the system* IMHO. Besides I don't think anyone reasonable allows unrestricted access to the voyager web page from the internet. 2) As I said before, that only works for a+r files, not every file on the system. Regards, Jorge -----Mensaje original----- De: Valdis.Kletnieks@vt.edu [mailto:Valdis.Kletnieks@vt.edu] Enviado el: Jueves, 24 de Abril de 2003 14:43 Para: Jorge Merlino CC: bugtraq@securityfocus.com Asunto: Re: Nokia IPSO Vulnerability On Thu, 24 Apr 2003 13:32:50 -0300, Jorge Merlino <jmerlino@easynet.com.uy> said: > I don't think that is a vulnerability. > The file /etc/master.passwd has read access for all users. Monitor can also > read it in a ssh session. 1) It being readable to all users *authorized to use the system* is different from it being readable to any bozo on the entire Internet. 2) /etc/master.password is used as a *Proof of Concept*. Feel free to substitute any other file that might be more damaging to have. Hmm.. it might be nice to snarf a copy of /etc/inetd.conf, see what's enabled.. or maybe I want to grab a copy of.....
