Possible vulnerability?

SmackDaddy · Posted: Fri Jun 04, 2004 6:10 am

I have only seen this posted on PortedMods.com:

Only registered users can see links on this board!
Get registered or login to the forums!

Thoughts/ideas?

Raven · Posted: Fri Jun 04, 2004 6:40 am

It's from Security-Focus 5/30. I had seen it there when it got posted as I check there most every day. In order for this to happen, the attacker has to have the ability to create a symlink in the nuke directory. The way I looked at that is this. If the person is able to create a symlink, you have much bigger problems than Nuke. I am not discounting this advisory, so don't misunderstand me. It needs to be plugged. There is also a "patch" to config.php that is posted there but I haven't tested it. WE will and someone will get back to this post. Thanks.

SmackDaddy · Posted: Fri Jun 04, 2004 6:48 am

Thanks Raven.....I didn't understand the symlink issue.....was just making sure I wasn't patching when I didn't need to as I seem to try and keep on top of security, but I think it's making people a bit trigger happy at every security alert and I just want to be safe.....again, thanks.

Raven · Posted: Fri Jun 04, 2004 6:57 am

In *nix environments you can have symlinks (a SYMbolicLINK, i.e. a pointer) to other folders. For example, Most hosts have a folder called public_html. You will also usually see a symbolic link "www" that points to public_html. So, you can reference that folder with either link.

SmackDaddy · Posted: Fri Jun 04, 2004 8:41 am

Ahhhhh...okay. Thanks.

chatserv · Posted: Fri Jun 04, 2004 8:55 am

The config.php suggestion seems valid, it needs to be tested though

Tank863 · New Member Joined: May 29, 2003 Posts: 16

I tried the config suggestion.. and the proff of concept blew right thru it....

hmmmmm....