drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mangelnde Rechteprüfung in MLDonkey
Name: |
Mangelnde Rechteprüfung in MLDonkey |
|
ID: |
200710-25 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Mi, 24. Oktober 2007, 23:50 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
Mldonkey |
|
Originalnachricht |
--rWhLK7VZz0iBluhq Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High Title: MLDonkey: Privilege escalation Date: October 24, 2007 Bugs: #189412 ID: 200710-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
The Gentoo MLDonkey ebuild adds a user to the system with a valid login shell and no password.
Background ==========
MLDonkey is a peer-to-peer filesharing client that connects to several different peer-to-peer networks, including Overnet and BitTorrent.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-p2p/mldonkey < 2.9.0-r3 >= 2.9.0-r3
Description ===========
The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so that the MLDonkey service can run under a user with low privileges. This user is created with a valid login shell and no password.
Impact ======
A remote attacker could log into a vulnerable system as the p2p user. This would require an installed login service that permitted empty passwords, such as SSH configured with the "PermitEmptyPasswords yes" option, a local login console, or a telnet server.
Workaround ==========
See Resolution.
Resolution ==========
Change the p2p user's shell to disallow login. For example, as root run the following command:
# usermod -s /bin/false p2p
NOTE: updating to the current MLDonkey ebuild will not remove this vulnerability, it must be fixed manually. The updated ebuild is to prevent this problem from occurring in the future.
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200710-25.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--rWhLK7VZz0iBluhq Content-Type: application/pgp-signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux)
iQEVAwUBRx+8ZjvRww8BFPxFAQIDxQf/f7tBC5ZD3Jvlh7x7l4wUMoS5vstbFpys wA3Vkz4yeYs5hB8htKBAVkrMeyWZGDQpr+wUtbVrW6fMZZDuAOpKHzYbr2ZIi9vd ybBlNbz3/kl5cIm/agF6eWkQqOqWHdV5S38+ShXJfvzqBKCG1I81N5wOrglyTKXG BwlWjp8GRCN99o/AFNr6B9AhYOVKkC7MBwt/LOYgnZXnAXUEO9sBSLtqdhZyGBeT B14clHlNbq/ofDxG0elHbDlfJUHobFmjaonqf3O+AflPwLvNX1igKjQPFSBz9nEW aRfxcfpeEpELEikp4UAU+2OkD9ZW5ISX79lhxVTYVC5VA58qL8A/0Q== =hFis -----END PGP SIGNATURE-----
--rWhLK7VZz0iBluhq-- -- gentoo-announce@gentoo.org mailing list
|
|
|
|