Description
Bournal before 1.4.1 on FreeBSD 8.0, when the -K option is used, places a ccrypt key on the command line, which allows local users to obtain sensitive information by listing the process and its arguments, related to "echoing."
References
- 20100222 Secunia Research: Bournal ccrypt Information Disclosure Security Issue mailing-list
- FEDORA-2010-3221 vendor-advisory
- FEDORA-2010-3168 vendor-advisory
- 38352 vdb-entry
- 38814 third-party-advisory
- 38723 third-party-advisory
- FEDORA-2010-3301 vendor-advisory
- http://secunia.com/secunia_research/2010-7/