[BusyBox 0001383]: login gives information on user existence
bugs at busybox.net
bugs at busybox.net
Fri Jun 8 15:32:20 UTC 2007
The following issue has been CLOSED
======================================================================
http://busybox.net/bugs/view.php?id=1383
======================================================================
Reported By: iggarpe
Assigned To: BusyBox
======================================================================
Project: BusyBox
Issue ID: 1383
Category: Security
Reproducibility: always
Severity: minor
Priority: normal
Status: closed
Resolution: open
Fixed in Version:
======================================================================
Date Submitted: 06-07-2007 04:57 PDT
Last Modified: 06-08-2007 08:32 PDT
======================================================================
Summary: login gives information on user existence
Description:
If a non existing user is entered at the login prompt, it will return an
error, istead of asking for the password as the standard login does. This
gives information to a potential attacker about the existence of given
user in the system.
No big deal but certainly a security leak easily fixable.
======================================================================
----------------------------------------------------------------------
bernhardf - 06-07-07 07:39
----------------------------------------------------------------------
Something like the attached patch? Can you test this, please?
thanks in advance and cheers,
----------------------------------------------------------------------
vda - 06-08-07 08:32
----------------------------------------------------------------------
Fixed in svn 18782. Thanks!
Issue History
Date Modified Username Field Change
======================================================================
06-07-07 04:57 iggarpe New Issue
06-07-07 04:57 iggarpe Status new => assigned
06-07-07 04:57 iggarpe Assigned To => BusyBox
06-07-07 07:39 bernhardf Note Added: 0002460
06-07-07 07:40 bernhardf File Added: busybox-trunk.bug1383.00.diff
06-08-07 08:32 vda Status assigned => closed
06-08-07 08:32 vda Note Added: 0002467
======================================================================
More information about the busybox-cvs
mailing list