reportbug information disclosure

ID USN-88-1
Type ubuntu
Reporter Ubuntu
Modified 2005-02-28T00:00:00


Rolf Leggewie discovered two information disclosure bugs in reportbug.

The per-user configuration file ~/.reportbugrc was created world-readable. If it contained email smarthost passwords, these were readable by any other user on the computer storing the home directory.

reportbug usually includes the settings from ~/.reportbugrc in generated bug reports. This included the “smtppasswd” setting (the password for an SMTP email smarthost) as well. The password is now hidden from reports.