The recent discussion of Xitami leads me to forward the following
excerpt.
----- Forwarded message from Network Computing and The SANS Institute -----
Date: Thu, 29 Nov 2001 18:47:58 -0700 (MST)
From: Network Computing and The SANS Institute
Subject: Security Alert Consensus #125
[ ... ]
*** {01.48.027} Cross - Xitami server world-readable configuration file
Xitami Web server version 2.4d9 has been found to leave the
configuration file world readable. This file contains the
administrative password, which a local user then could use to
reconfigure the server and potentially read arbitrary files because
of the server's running with root privileges.
This vulnerability has not been confirmed.
Source: VulnWatch
http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0055.html
[ ... ]
----- End forwarded message -----
--
-----------------------------------------------------------------
Dan Wilder <[EMAIL PROTECTED]> Technical Manager & Editor
SSC, Inc. P.O. Box 55549 Phone: 206-782-8808
Seattle, WA 98155-0549 URL http://embedded.linuxjournal.com/
-----------------------------------------------------------------
_______________________________________________
Webware-discuss mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/webware-discuss
