Slashdot Mirror

← Back to Stories (view on slashdot.org)

Root Password Readable in Clear Text with Ubuntu

Posted by ryuzaki0 on from the that's-a-big-oops dept.

BBitmaster writes "An extremely critical bug and security threat was discovered in Ubuntu Breezy Badger 5.10 earlier today by a visitor on the Ubuntu Forums that allows anyone to read the root password simply by opening an installer log file. Apparently the installer fails to clean its log files and leaves them readable to all users. The bug has been fixed, and only affects The 5.10 Breezy Badger release. Ubuntu users, be sure to get the patch right away."

2 of 520 comments (clear)

  1. Security Audit by RunFatBoy.net · · Score: 0, Redundant

    A thanks to Teotihacan for finding this. I'm sure that eventually several sysadmins would have failed security audits because of this. -- Jim http://www.runfatboy.net/

  2. [easier] Solution by tpgp · · Score: 0, Redundant
    Open a terminal and type:
    sudo grep -r <my password> /var/log
    (if it returns your password, you're vulnerable)
    $ sudo apt-get update
    $ sudo passwd base-config
    (wait)
    $ sudo grep -r <my password> /var/log
    (if it doesn't return your password, you're no longer vulnerable)

    On a side note - this is pretty bad - sure a lot of people are going to say this is local privilige escalation only, but combined with any other exploit, this allows an attacker root access.

    This is the reason I use Debian for anything serious....
    --
    My pics.