Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 30 Jan 2012 10:08:16 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Jonathan Wiltshire <jmw@...ian.org>,
        Nanakos Chrysostomos <nanakos@...ed-net.gr>,
        Gian Piero Carrubba <gpiero@...rf.it>, team@...urity.debian.org
Subject: Re: Re: Yubiserver package ships with pre-filled identities

On 01/30/2012 04:56 AM, Jonathan Wiltshire wrote:
> On 2012-01-30 06:43, Nanakos Chrysostomos wrote:
>> Hi again,
>> I found another reason for not shipping the package with an example
>> account. I think you are certainly right. If you haven't filled a bug
>> please do so, in the meanwhile I will upload to mentors a new version
>> with an empty database that resolves the problem. Thanks.
> 
> This populated database is also shipped in the upstream tarball,
> oss-security should be consulted to see whether a CVE identifier should
> be issued.
> 
> Adding to CC; oss-sec please see below:
> 
> 
>> On 30 Ιαν 2012, at 1:25, Gian Piero Carrubba <gpiero@...rf.it> wrote:
>>
>>> Hi Nanakos,
>>>
>>> thanks for your prompt response.
>>>
>>> * [Sun, Jan 29, 2012 at 11:19:37PM +0200] Nanakos Chrysostomos:
>>>> those keys are invalid and are not my real keys. It's just a sample
>>>> for the potential users of the package to see.

Ok I'm not clear on what is going on here, is there a link to the bug
entry regarding this issue, or can someone clarify it?

1) are there default accounts shipped with the product that get
activated automatically during install? (it sounds like yes?)

2) can someone remotely/locally access these accounts? what are the
credentials for these accounts ("invalid keys"?), can an attacker access
them?

3) what is the privilege level of the accounts?



-- 
Kurt Seifried Red Hat Security Response Team (SRT)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ