[13346] in bugtraq
Re: CyberCash MCK 3.2.0.4: Large /tmp hole (fwd)
daemon@ATHENA.MIT.EDU (Dave G.)
Fri Jan 14 21:52:31 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.10.10001131722550.911-100000@www.ksrt.org>
Date: Thu, 13 Jan 2000 17:33:36 -0500
Reply-To: dhg@KSRT.ORG
From: "Dave G." <dhg@KSRT.ORG>
X-To: BUGTRAQ@SECURITYFOCUS.COM, Sheldon Young <sheldon_young@YAHOO.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.LNX.4.10.10001131720410.902-100000@www.ksrt.org>
>
> Manfuacturer: CyberCash (http://www.cybercash.com)
> Software: Merchant Connection Kit
> Version: 3.2.0.4
>
KSR[T] had a similiar advisory coming out, which also discussed that the C
API had similiar /tmp problems, and possibly some other potential attacks.
We will make the advisory available on the website by the end of Friday.
Since I don't have the advisory in front of me, I can't confirm the
details of the C API.
The most important factor to this vulnerability (as discussed by Sheldon)
is that local users can halt businesses that rely on Cybercash to process
credit card orders from doing business over the web.
Another item to note is that there is also an active server page version
of Cybercash which remains unaudited.
Dave G.
http://www.ksrt.org
http://www.ksrt.org/~daveg
