The at program in IRIX 6.2 and NetBSD 1.3.2 and earlier allows local users to read portions of arbitrary files by submitting the file to at with the -f argument, which generates error messages that at sends to the user via e-mail.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Irix | Sgi | 6.2 (including) | 6.2 (including) |
| Irix | Sgi | 6.4 (including) | 6.4 (including) |
| Irix | Sgi | 6.5 (including) | 6.5 (including) |
| Irix | Sgi | 6.5.1 (including) | 6.5.1 (including) |
References
- ftp://ftp.NetBSD.ORG/pub/NetBSD/security/advisories/NetBSD-SA1998-004.txt.asc
- http://marc.info/?l=bugtraq\u0026m=90233906612929\u0026w=2
- http://www.iss.net/security_center/static/7577.php
- http://www.securityfocus.com/bid/331
- http://www.shmoo.com/mail/bugtraq/jul98/msg00064.html
- ftp://ftp.NetBSD.ORG/pub/NetBSD/security/advisories/NetBSD-SA1998-004.txt.asc
- http://marc.info/?l=bugtraq\u0026m=90233906612929\u0026w=2
- http://www.iss.net/security_center/static/7577.php
- http://www.securityfocus.com/bid/331
- http://www.shmoo.com/mail/bugtraq/jul98/msg00064.html