system/3128: Session scrollback security exposure >Number: 3128
>Category: system
>Synopsis: Console logout does not clear scrollback buffer.
>Confidential: no
shopip.com
>Environment:
System : OpenBSD 3.2
Architecture: OpenBSD.i386
Machine : i386
>Description:
When logging out the console screen is cleared, however the scrollback
buffer is not. Someone not even logged in can view 7 (?) pages of
output from the previous session. A security exposure.
>How-To-Repeat:
Log in, log out, then use shift-scrollup/down to view the scrollback
buffer output.
>Fix:
Workaround: Right after logout, use ctrl-alt Fn to switch console, then
switch back. This erases scrollback buffer (unfortunately, but
it's useful here).
Fix: Clear the scrollback buffer at console logout time.
>Release-Note:
Received on Sun Mar 2 14:18:30 2003
This archive was generated by hypermail 2.1.8
: Wed Aug 23 2006 - 13:29:51 EDT
|