Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
User impersonation for lib9p based 9p fileservers
Vulnerability Description
A bug in the 9p authentication implementation within lib9p allows an attacker with an existing valid user within the configured auth server to impersonate any other valid filesystem user. This is due to lib9p not properly verifying that the uname given in the Tauth and Tattach 9p messages matches the client UID returned from the factotum authentication handshake. The only filesystem making use of these functions within the base 9front systems is the experimental hjfs disk filesystem, other disk filesystems (cwfs and gefs) are not affected by this bug. This bug was inherited from Plan 9 and is present in all versions of 9front and is remedied fully in commit 9645ae07eb66a59015e3e118d0024790c37400da.
CVSS Information
N/A
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
lib9p 安全漏洞
Vulnerability Description
lib9p是Conclusive Engineering开源的一个实现 9p2000、9p2000.u 和 9p2000 的服务器库。 lib9p 存在安全漏洞，该漏洞源于身份验证错误，允许攻击者在配置的身份验证服务器中拥有现有有效用户，从而冒充任何其他有效文件系统用户。
CVSS Information
N/A
Vulnerability Type
N/A