Description
The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.
References
- sarab-ciphers-information-disclosure(42621) vdb-entry
- http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?r1=34&r2=36
- http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?view=log
- ADV-2008-1659 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=601603&group_id=91804
- 29364 vdb-entry
- 30394 third-party-advisory