awakening team mailing list archive

[Pietry <pietry@xxxxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Public security bug reported:

I can use user commands to send a message like BMSG somesid message,
where somesid can be some operator's SID. In this case, I can talk in
anybody's name, but even more, I can even take all the hub commands.
This is an extreme security vulnerability.

** Affects: ehub
     Importance: Undecided
         Status: New

** Visibility changed to: Public

-- 
Anybody can use anybody's SID with no consequences
https://bugs.launchpad.net/bugs/244668
You received this bug notification because you are a member of
Awakening, which is a direct subscriber.

Status in eHub: New

Bug description:
I can use user commands to send a message like BMSG somesid message, where somesid can be some operator's SID. In this case, I can talk in anybody's name, but even more, I can even take all the hub commands. This is an extreme security vulnerability.