Cobalt RaQ .bash_history漏洞

漏洞信息详情

Cobalt RaQ .bash_history漏洞

• CNNVD编号：CNNVD-199902-055
• 危害等级： 超危
  
  
• CVE编号：
  CVE-1999-0408
  
• 漏洞类型：
  
  
  设计错误
  
• 发布时间：
  
  1999-02-25
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2006-08-28
  
• 厂        商：
  
  sun
• 漏洞来源：
  A security notice …

Cobalt RaQ微型服务器(如 .bash_history)存在漏洞。它的交互shell会话创建的文件全局可读，因此可以从web服务器访问该文件。

Cobalt released a patch for this problem obtainable at ftp://ftp.cobaltnet.com/pub/security.
In addition to installing this patch, one should add the following to /etc/profile:
touch $HISTFILE
chmod 600 $HISTFILE
For added security, one could change the HISTFILE variable itself.
Apache, the installed webserver on Cobalt RaQs can solve the problem as well if the following is added to the apache configuration:

order allow,deny
deny from all

来源: BID
名称: 337
链接:http://www.securityfocus.com/bid/337