Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Critical] Security Hole #17

Closed
DaneEveritt opened this issue Dec 6, 2013 · 2 comments
Closed

[Critical] Security Hole #17

DaneEveritt opened this issue Dec 6, 2013 · 2 comments
Assignees
@DaneEveritt

Comments

@DaneEveritt
Copy link
Contributor

It has come to my attention that there is a critical security hole in the software. If you are currently running this installation on a server that people are able to access please disable it.

This bug occurs if two servers on the same node have the same name. The bug would allow for users to access data for the other server via the console and power options. This bug will be patched shortly. Until then you should disable the software or ensure that all servers have a unique name.
@ghost ghost assigned DaneEveritt Dec 6, 2013
DaneEveritt added a commit that referenced this issue Dec 6, 2013
@DaneEveritt
Implement generateServerToken() into power functions in reference to …
a7e4120 
…issue #17
DaneEveritt added a commit that referenced this issue Dec 6, 2013
@DaneEveritt
Implement generateServerToken() in reference to issue #17
38d498c
DaneEveritt added a commit that referenced this issue Dec 6, 2013
@DaneEveritt
Implement generateServerToken() in reference to issue #17
1db9fac
DaneEveritt added a commit that referenced this issue Dec 6, 2013
@DaneEveritt
Implement generateServerToken() in reference to issue #17
375b89f
@DaneEveritt
Copy link
Contributor Author

This issue has been patched at the time of writing. We will continue to evaluate code to ensure it remains safe.

@DaneEveritt
Copy link
Contributor Author

This security hole was found to be a non-issue upon further review. All FTP accounts are given unique names and used to identify servers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DaneEveritt DaneEveritt

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@DaneEveritt