Slackware Net Installation Vulnerability
BID:338
Info
Slackware Net Installation Vulnerability
| Bugtraq ID: | 338 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 17 1999 12:00AM |
| Updated: | Mar 17 1999 12:00AM |
| Credit: | First revealed in ISS X-Force Advisory ISS-021 on March 17, 1999. |
| Vulnerable: |
Slackware Linux 3.6 |
| Not Vulnerable: | |
Discussion
Slackware Net Installation Vulnerability
Slackware linux is vulnerable to remote root compromise immediately after install in some cases. These cases involve the installation of Slackware over a network, using the net.i image or a network enabled kernel. The vulnerability lies in the Slackware Linux installation's setting of the root password to NULL. Furthermore, /etc/securetty is configured so that root can login on the pttys (psuedoterminals) allowing remote root logins. The consequence of this is that, immediately after install, upon reboot of the new Slackware Linux machine, an intruder can login as root from anywhere on the network (or internet) where the machine can be accessed via telnet or any of the other remote-login services.
Slackware linux is vulnerable to remote root compromise immediately after install in some cases. These cases involve the installation of Slackware over a network, using the net.i image or a network enabled kernel. The vulnerability lies in the Slackware Linux installation's setting of the root password to NULL. Furthermore, /etc/securetty is configured so that root can login on the pttys (psuedoterminals) allowing remote root logins. The consequence of this is that, immediately after install, upon reboot of the new Slackware Linux machine, an intruder can login as root from anywhere on the network (or internet) where the machine can be accessed via telnet or any of the other remote-login services.
Solution / Fix
Slackware Net Installation Vulnerability
Solution:
The post 3.6 Slackware Linux distributions have addressed this issue. It is advised that Slackware Linux 3.6 installations are done locally via local media (CDROM, HDD). Immediately after installation, /etc/securetty should have the entries for the pttys allowing remote root logins changed.
Solution:
The post 3.6 Slackware Linux distributions have addressed this issue. It is advised that Slackware Linux 3.6 installations are done locally via local media (CDROM, HDD). Immediately after installation, /etc/securetty should have the entries for the pttys allowing remote root logins changed.