| Summary: | <www-client/surf-0.4.1-r1 : world-readable cookie file (CVE-2012-0842) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | jer |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296 | ||
| Whiteboard: | ~4 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
Fixed in -r1. Closed as noglsa. Thanks |
From debian bugzilla at $URL: $ ls -ld ~/.surf/{,cookies.txt} drwxr-xr-x 2 user users 4096 Feb 9 22:59 /home/user/.surf/ -rw-r--r-- 1 user users 406 Feb 9 22:59 /home/user/.surf/cookies.txt This allows local users to steal cookies. I consider it as upstream ebuild because anyone is able to change permission without upstream support