Re: surfboard1.1.6 local exploit.
I'm...mildly impressed. Someone's still *using* that thing? Not that
things have changed in this regard, but the latest version is 1.1.9,
anyway.
Serious question, actually - they shouldn't exist, I know (believe me, I
don't still code like that...), but exactly how severe is a hole such
as this, which is only exploitable by the user who is running the
daemon in the first place? Unless you're doing something like running
the daemon as root, with a user-modifiable config file (at which point
you have much more serious problems, like CGI), this doesn't actually
escalate someone's privilege at all.
On Tuesday 11 May 2004 21:19, Anonymous wrote:
> Solution:
>
> fluffy has written a great cmd line hack to solve the problem:
>
> for i in `locate surfboard`; do rm -rf $i ; done
>
> Should do the trick ;)
Unfortunately, fluffy has neglected the file actually
responsible, /usr/local/bin/surfd. Sorry to break it to him/her/it :^)
fluffy also forgot the next line, which goes something along the lines
of:
apt-get install apache
Seriously. You shouldn't be using this lump of junk. Anyway, you
*definitely* shouldn't be using 1.1.6, cause there's a good couple of
arbitrary-traversal holes in there, along with tons of bugs (something
you'd know if you read the archives of this list). 1.1.9 was the latest
at time of announcement, and v1.1.10 is now on the sourceforge site,
for any fool who's still using it...
Meredydd