<div dir="ltr"><div><div>Yes it can. I think restricting access to the kickstart directory makes sense. <br></div>Can you please log an issue over at <a href="http://github.com/cobbler/cobbler">http://github.com/cobbler/cobbler</a><br>
<br></div>Thanks!<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, May 8, 2014 at 8:03 AM, Dolev Farhi <span dir="ltr"><<a href="mailto:D.Farhi@f5.com" target="_blank">D.Farhi@f5.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Can this be taken into consideration in next release?<br>
<br>
<br>
<br>
<br>
--<br>
df<br>
<div class="HOEnZb"><div class="h5"><br>
-----Original Message-----<br>
From: <a href="mailto:cobbler-bounces@lists.fedorahosted.org">cobbler-bounces@lists.fedorahosted.org</a> [mailto:<a href="mailto:cobbler-bounces@lists.fedorahosted.org">cobbler-bounces@lists.fedorahosted.org</a>] On Behalf Of Christopher Liebman<br>
Sent: Thursday, May 08, 2014 12:00 AM<br>
To: cobbler mailing list<br>
Subject: Re: [cobbler] Cobbler WebUI file inclusion in profile page<br>
<br>
Ahh - interesting viewpoint.<br>
<br>
On May 7, 2014, at 12:30 PM, Dolev Farhi <D.Farhi@F5.com> wrote:<br>
<br>
> Hi<br>
><br>
> This sounds a little weird to me, a user mis configuration leads to crucial system files exposure? Doesnt it sound reasonable to have some sort of a file restriction or path restriction to include files from (especially if these are just kickstart files)<br>
> Considering sometimes cobbler deployments are not done by sysadmins or other IT personnel it is worrying us that pretty much any file is exposed via cobbler webUI.<br>
> ________________________________________<br>
> From: <a href="mailto:cobbler-bounces@lists.fedorahosted.org">cobbler-bounces@lists.fedorahosted.org</a> [<a href="mailto:cobbler-bounces@lists.fedorahosted.org">cobbler-bounces@lists.fedorahosted.org</a>] on behalf of Christopher Liebman [<a href="mailto:liebman@zod.com">liebman@zod.com</a>]<br>
> Sent: Wednesday, May 07, 2014 5:59 PM<br>
> To: cobbler mailing list<br>
> Subject: Re: [cobbler] Cobbler WebUI file inclusion in profile page<br>
><br>
> Hmm, I'm not sure that I would classify a user mis-configuration as a software security issue.<br>
><br>
> -- Chris<br>
><br>
> On May 7, 2014, at 4:28 AM, Dolev Farhi <D.Farhi@F5.com<mailto:<a href="mailto:D.Farhi@F5.com">D.Farhi@F5.com</a>>> wrote:<br>
><br>
> hello,<br>
><br>
> I would like to know whether this issue has been addressed before:<br>
><br>
> I have created a regular cobbler profile, nothing fancy.<br>
><br>
> The only thing I did different is changing the ‘Kickstart’ value to the famous /etc/passwd file.<br>
><br>
> After saving the profile, I went to ‘View Kickstart’ and managed to get all the passwd content.<br>
><br>
> This issue allows any remote attacker to get the local users list and I am quite sure this can be classified as a security vulnerability.<br>
><br>
> Please let me know as we have multiple cobbler instances here.<br>
><br>
> --<br>
><br>
> df<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> cobbler mailing list<br>
> <a href="mailto:cobbler@lists.fedorahosted.org">cobbler@lists.fedorahosted.org</a><mailto:<a href="mailto:cobbler@lists.fedorahosted.org">cobbler@lists.fedorahosted.org</a>><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/cobbler" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/cobbler</a><br>
><br>
> _______________________________________________<br>
> cobbler mailing list<br>
> <a href="mailto:cobbler@lists.fedorahosted.org">cobbler@lists.fedorahosted.org</a><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/cobbler" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/cobbler</a><br>
<br>
_______________________________________________<br>
cobbler mailing list<br>
<a href="mailto:cobbler@lists.fedorahosted.org">cobbler@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/cobbler" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/cobbler</a><br>
_______________________________________________<br>
cobbler mailing list<br>
<a href="mailto:cobbler@lists.fedorahosted.org">cobbler@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/cobbler" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/cobbler</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Grtz,<br>Jörgen Maas
</div>