[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
pkg/40532: privoxy ignores user:group and has wheel permissions and so everyone accessing privoxy admin page
>Synopsis: privoxy ignores user:group and has wheel permissions and so
>everyone accessing privoxy admin page
>Arrival-Date: Sun Feb 01 16:50:00 +0000 2009
>Originator: Cem Kayali
>Release: NetBSD5 amd64
NetBSD localhost 4.99.7X root@localhost:/usr/obj/sys/arch/amd64/compile/GENERIC
If you build privoxy through pkgsrc it has automatic wheel permissions, which
allows everyone who has access to privoxy administration page (p.p) to modify
all wheel permissioned files.
This is similar to pkg/38252 one i think.
PS: Please upgrade this software to latest 3.0.10 too.
Build privoxy through pkgsrc
Move its rc.d script to /etc/rc.d
Insert privoxy=yes to /etc/rc.conf
Boot computer or start privoxy
Set /usr/pkg/etc/privoxy/* to 661
Run a browser using a test username, type and check
Notice all wheel permissioned (661) files are writeable.
Main Index |
Thread Index |