From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1IkoIQ-0001Cj-JS for garchives@archives.gentoo.org; Wed, 24 Oct 2007 22:01:51 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.1/8.14.0) with SMTP id l9OLx1WD022208; Wed, 24 Oct 2007 21:59:01 GMT Received: from mx1.falcal.net (falco.bz [88.162.192.139]) by robin.gentoo.org (8.14.1/8.14.0) with ESMTP id l9OLh2S6007090 for ; Wed, 24 Oct 2007 21:43:02 GMT Received: by mx1.falcal.net (Postfix, from userid 1000) id 44CB125E02C; Wed, 24 Oct 2007 23:43:02 +0200 (CEST) Date: Wed, 24 Oct 2007 23:43:02 +0200 From: Raphael Marichez To: gentoo-announce@gentoo.org Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, security-alerts@linuxsecurity.com Subject: [gentoo-announce] [ GLSA 200710-25 ] MLDonkey: Privilege escalation Message-ID: <20071024214302.GG2915@falco.falcal.net> Mail-Followup-To: gentoo-announce@gentoo.org, bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, security-alerts@linuxsecurity.com Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="rWhLK7VZz0iBluhq" Content-Disposition: inline X-Web: http://falco.bz/ X-GPG-fingerprint: 04EB 153A 6B28 3E80 87A9 9B4F A77C 4BDE 021C 5BD2 X-GPG-Key: http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x021C5BD2 Organization: Gentoo Linux Security Team User-Agent: Mutt/1.5.16 (2007-06-09) X-Archives-Salt: 2e44ec64-6c8b-4860-9e92-883fac81e229 X-Archives-Hash: af182843d51f672d37262de8c5df012d --rWhLK7VZz0iBluhq Content-Type: text/plain; charset=us-ascii Content-Disposition: inline - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: MLDonkey: Privilege escalation Date: October 24, 2007 Bugs: #189412 ID: 200710-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== The Gentoo MLDonkey ebuild adds a user to the system with a valid login shell and no password. Background ========== MLDonkey is a peer-to-peer filesharing client that connects to several different peer-to-peer networks, including Overnet and BitTorrent. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-p2p/mldonkey < 2.9.0-r3 >= 2.9.0-r3 Description =========== The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so that the MLDonkey service can run under a user with low privileges. This user is created with a valid login shell and no password. Impact ====== A remote attacker could log into a vulnerable system as the p2p user. This would require an installed login service that permitted empty passwords, such as SSH configured with the "PermitEmptyPasswords yes" option, a local login console, or a telnet server. Workaround ========== See Resolution. Resolution ========== Change the p2p user's shell to disallow login. For example, as root run the following command: # usermod -s /bin/false p2p NOTE: updating to the current MLDonkey ebuild will not remove this vulnerability, it must be fixed manually. The updated ebuild is to prevent this problem from occurring in the future. Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200710-25.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --rWhLK7VZz0iBluhq Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iQEVAwUBRx+8ZjvRww8BFPxFAQIDxQf/f7tBC5ZD3Jvlh7x7l4wUMoS5vstbFpys wA3Vkz4yeYs5hB8htKBAVkrMeyWZGDQpr+wUtbVrW6fMZZDuAOpKHzYbr2ZIi9vd ybBlNbz3/kl5cIm/agF6eWkQqOqWHdV5S38+ShXJfvzqBKCG1I81N5wOrglyTKXG BwlWjp8GRCN99o/AFNr6B9AhYOVKkC7MBwt/LOYgnZXnAXUEO9sBSLtqdhZyGBeT B14clHlNbq/ofDxG0elHbDlfJUHobFmjaonqf3O+AflPwLvNX1igKjQPFSBz9nEW aRfxcfpeEpELEikp4UAU+2OkD9ZW5ISX79lhxVTYVC5VA58qL8A/0Q== =hFis -----END PGP SIGNATURE----- --rWhLK7VZz0iBluhq-- -- gentoo-announce@gentoo.org mailing list