3/18/2006
Ubuntu security advisory
SecurityFocus reports a vulnerability in Ubuntu
The problem is that the root password is stored in clear-text in a world-readable installer log file, verifiable by running grep password /var/log/installer/cdebconf/questions.dat
There is a fix available…
Basically you just need to do a regular update to get the latest base-config package, which changes the permissions of the file so that it is no longer world-readable. i.e.:
before
$ ls -l /var/log/installer/cdebconf/questions.dat -rw-r--r-- 1 root root 61052 2005-12-12 01:44 /var/log/installer/cdebconf/questions.dat
after
$ ls -l /var/log/installer/cdebconf/questions.dat -rw------- 1 root root 61018 2006-03-18 11:36 /var/log/installer/cdebconf/questions.dat
Books on Ubuntu from Amazon
Del.icio.us
Digg
Reddit
Technorati
Possibly related posts
No comments yet. Be the first.
Leave a reply
RSS 2.0 feed
