[611] in Moira
seeing other people's pobox info
daemon@ATHENA.MIT.EDU (Carla Fermann)
Thu May 20 14:36:44 1993
To: bug-moira@Athena.MIT.EDU
Cc: marc@Athena.MIT.EDU
Date: Thu, 20 May 93 14:36:25 EDT
From: Carla Fermann <carla@Athena.MIT.EDU>
Hi! It seems that any athena user can look at any other person's pobox
info with "chpobox -u username".
The man page for chpobox says:
Regular users may change and retrieve information about only their own
post office boxes. Moira database administrators can change or retrieve
information about any user's post office box, specifying the user with
the -u option.
though.
(We had a user with no special moira access check on a bunch of
people, and he was able to see all of their pobox info. He was on a
vs3100, but I don't think that matters).
Thanks,
Carla
