Ubuntu Linux Local Installation Password Disclosure Vulnerability
BID:17086
Info
Ubuntu Linux Local Installation Password Disclosure Vulnerability
| Bugtraq ID: | 17086 |
| Class: | Design Error |
| CVE: |
CVE-2006-1183 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 12 2006 12:00AM |
| Updated: | Nov 01 2007 07:36PM |
| Credit: | Discovered by Karl �?ie. |
| Vulnerable: |
Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 |
| Not Vulnerable: | |
Discussion
Ubuntu Linux Local Installation Password Disclosure Vulnerability
Ubuntu Linux is prone to a local password-disclosure vulnerability because the installation system improperly store clear-text passwords in world-readable files.
Exploiting this issue allows local attackers to access the user account that was created during the initial installation of Ubuntu. Since this user is granted 'sudo' access to the superuser account, this potentially allows local attackers to completely compromise affected computers.
Ubuntu Linux is prone to a local password-disclosure vulnerability because the installation system improperly store clear-text passwords in world-readable files.
Exploiting this issue allows local attackers to access the user account that was created during the initial installation of Ubuntu. Since this user is granted 'sudo' access to the superuser account, this potentially allows local attackers to completely compromise affected computers.
Exploit / POC
Ubuntu Linux Local Installation Password Disclosure Vulnerability
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Ubuntu Linux Local Installation Password Disclosure Vulnerability
Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the advisory for more information.
Ubuntu Ubuntu Linux 5.10 amd64
Ubuntu Ubuntu Linux 5.10 powerpc
Ubuntu Ubuntu Linux 5.10 i386
Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the advisory for more information.
Ubuntu Ubuntu Linux 5.10 amd64
-
Ubuntu initial-passwd-udeb_4.0.3-37ubuntu8_all.udeb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/initial-passwd-ud eb_4.0.3-37ubuntu8_all.udeb -
Ubuntu login_4.0.3-37ubuntu8_amd64.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_amd64.deb -
Ubuntu login_4.0.3-37ubuntu8_i386.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_i386.deb -
Ubuntu login_4.0.3-37ubuntu8_powerpc.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_powerpc.deb -
Ubuntu passwd_4.0.3-37ubuntu8_amd64.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_amd64.deb -
Ubuntu passwd_4.0.3-37ubuntu8_i386.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_i386.deb -
Ubuntu passwd_4.0.3-37ubuntu8_powerpc.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_powerpc.deb
Ubuntu Ubuntu Linux 5.10 powerpc
-
Ubuntu initial-passwd-udeb_4.0.3-37ubuntu8_all.udeb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/initial-passwd-ud eb_4.0.3-37ubuntu8_all.udeb -
Ubuntu login_4.0.3-37ubuntu8_amd64.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_amd64.deb -
Ubuntu login_4.0.3-37ubuntu8_i386.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_i386.deb -
Ubuntu login_4.0.3-37ubuntu8_powerpc.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_powerpc.deb -
Ubuntu passwd_4.0.3-37ubuntu8_amd64.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_amd64.deb -
Ubuntu passwd_4.0.3-37ubuntu8_i386.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_i386.deb -
Ubuntu passwd_4.0.3-37ubuntu8_powerpc.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_powerpc.deb
Ubuntu Ubuntu Linux 5.10 i386
-
Ubuntu initial-passwd-udeb_4.0.3-37ubuntu8_all.udeb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/initial-passwd-ud eb_4.0.3-37ubuntu8_all.udeb -
Ubuntu login_4.0.3-37ubuntu8_amd64.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_amd64.deb -
Ubuntu login_4.0.3-37ubuntu8_i386.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_i386.deb -
Ubuntu login_4.0.3-37ubuntu8_powerpc.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/login_4.0.3-37ubu ntu8_powerpc.deb -
Ubuntu passwd_4.0.3-37ubuntu8_amd64.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_amd64.deb -
Ubuntu passwd_4.0.3-37ubuntu8_i386.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_i386.deb -
Ubuntu passwd_4.0.3-37ubuntu8_powerpc.deb
Ubuntu 5.10 (Breezy Badger)
http://security.ubuntu.com/ubuntu/pool/main/s/shadow/passwd_4.0.3-37ub untu8_powerpc.deb
References
Ubuntu Linux Local Installation Password Disclosure Vulnerability
References:
References: