Hobbit monitor: Security issue with Hobbit 4.2-beta client

list Henrik Størner
Fri, 30 Jun 2006 23:14:52 +0200
Message-Id: <user-3899614c7e1f@xymon.invalid>

On Fri, Jun 30, 2006 at 02:30:47PM -0400, Jason Chambers wrote:

Can you please verify this for me. This only affects if a user is able
to login to the system, and not the services that may be installed on
the computer. (ie ftp, web)

Correct. To exploit this, you must be able to create a file on the
system, and run the logfetch command with a special commandline option.


Regards,
Henrik