|
xtell Log File Symbolic Link Attack
xtell is a simple network messaging program. It may be used to transmit terminal messages between users and machines. xtell is available for Linux, BSD and most other Unix based operating systems. If a file .xtell-log is available in a given user's home directory, and writable by the xtell daemon, certain events will be logged. The xtell process normally runs as the user 'nobody', and the group 'tty'. A race condition vulnerability has been reported in xtell. It may be possible to create a symbolic link with the file name .xtell-log in a manner that will evade the checks performed by xtell. Earlier versions of xtell may share some or all of these vulnerabilities. This has not been confirmed. |
|
 Privacy Statement |
