AOH :: HP Unsorted E :: B06-1966.HTM

Ejabberd : symlink vulnerability during installation process



Ejabberd : Symlink vulnerability during installation process
Ejabberd : Symlink vulnerability during installation process



Date                : 2006-04-25
Vendor : www.process-one.net 
Products            : ejabberd binary installation for Linux
Vulnerable Versions : 1.1.1_1 and prior versions


When root user is running ejabberd-1.1.1_1-linux-installer.bin (in
order to install the Jabber server ejabberd). It creates in an insecure mode 
a file named bitrock_installer.log in the /tmp directory.

Local users are abble to perform a symlink attack and then cause
a DoS on the local machine.

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar - get it now! 
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ 


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.