On Thu, 24 Apr 2003 13:32:50 -0300, Jorge Merlino <jmerlino@easynet.com.uy> said: > I don't think that is a vulnerability. > The file /etc/master.passwd has read access for all users. Monitor can also > read it in a ssh session. 1) It being readable to all users *authorized to use the system* is different from it being readable to any bozo on the entire Internet. 2) /etc/master.password is used as a *Proof of Concept*. Feel free to substitute any other file that might be more damaging to have. Hmm.. it might be nice to snarf a copy of /etc/inetd.conf, see what's enabled.. or maybe I want to grab a copy of.....
Attachment:
pgp00343.pgp
Description: PGP signature
