[38654] in bugtraq
insecure user account lam-runtime-7.0.6-2mdk rpm
daemon@ATHENA.MIT.EDU (Scott Grayban)
Thu Apr 28 17:10:48 2005
Date: 28 Apr 2005 09:34:55 -0000
Message-ID: <20050428093455.7294.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Scott Grayban <sgrayban@borgnet.us>
To: bugtraq@securityfocus.com
Serverity: HIGH
I found a bug when lam-runtime-7.0.6-2mdk is installed it creates a new user/group with insecure permissions.
BUG:
user "mpi" is created without a password which can be used to compromise a system.
# rpm -qf /var/lib/mpi/test_mpi.lam
lam-runtime-7.0.6-2mdk
FIX:
Either lock the account, delete the directory or remove the rpm package.
Vendor notified: 04.27.2005 19:01
