Home page logo
/

bugtraq logo Bugtraq mailing list archives

insecure user account lam-runtime-7.0.6-2mdk rpm
From: Scott Grayban <sgrayban () borgnet us>
Date: 28 Apr 2005 09:34:55 -0000



Serverity: HIGH

I found a bug when lam-runtime-7.0.6-2mdk is installed it creates a new user/group with insecure permissions.

BUG:

user "mpi" is created without a password which can be used to compromise a system.
# rpm -qf /var/lib/mpi/test_mpi.lam
lam-runtime-7.0.6-2mdk

FIX:

Either lock the account, delete the directory or remove the rpm package.

Vendor notified: 04.27.2005 19:01


  By Date           By Thread  

Current thread:
  • insecure user account lam-runtime-7.0.6-2mdk rpm Scott Grayban (Apr 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]