Mangelnde Rechteprüfung in MLDonkey
ID: | 200710-25 |
Distribution: | Gentoo |
Plattformen: | Keine Angabe |
Datum: | Mi, 24. Oktober 2007, 23:50 |
Referenzen: | Keine Angabe |
Applikationen: | Mldonkey |
Originalnachricht |
|
--rWhLK7VZz0iBluhq Content-Type: text/plain; charset=us-ascii Content-Disposition: inline - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: MLDonkey: Privilege escalation Date: October 24, 2007 Bugs: #189412 ID: 200710-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== The Gentoo MLDonkey ebuild adds a user to the system with a valid login shell and no password. Background ========== MLDonkey is a peer-to-peer filesharing client that connects to several different peer-to-peer networks, including Overnet and BitTorrent. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-p2p/mldonkey < 2.9.0-r3 >= 2.9.0-r3 Description =========== The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so that the MLDonkey service can run under a user with low privileges. This user is created with a valid login shell and no password. Impact ====== A remote attacker could log into a vulnerable system as the p2p user. This would require an installed login service that permitted empty passwords, such as SSH configured with the "PermitEmptyPasswords yes" option, a local login console, or a telnet server. Workaround ========== See Resolution. Resolution ========== Change the p2p user's shell to disallow login. For example, as root run the following command: # usermod -s /bin/false p2p NOTE: updating to the current MLDonkey ebuild will not remove this vulnerability, it must be fixed manually. The updated ebuild is to prevent this problem from occurring in the future. Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200710-25.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --rWhLK7VZz0iBluhq Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iQEVAwUBRx+8ZjvRww8BFPxFAQIDxQf/f7tBC5ZD3Jvlh7x7l4wUMoS5vstbFpys wA3Vkz4yeYs5hB8htKBAVkrMeyWZGDQpr+wUtbVrW6fMZZDuAOpKHzYbr2ZIi9vd ybBlNbz3/kl5cIm/agF6eWkQqOqWHdV5S38+ShXJfvzqBKCG1I81N5wOrglyTKXG BwlWjp8GRCN99o/AFNr6B9AhYOVKkC7MBwt/LOYgnZXnAXUEO9sBSLtqdhZyGBeT B14clHlNbq/ofDxG0elHbDlfJUHobFmjaonqf3O+AflPwLvNX1igKjQPFSBz9nEW aRfxcfpeEpELEikp4UAU+2OkD9ZW5ISX79lhxVTYVC5VA58qL8A/0Q== =hFis -----END PGP SIGNATURE----- --rWhLK7VZz0iBluhq-- -- gentoo-announce@gentoo.org mailing list |