Back to list
May 11 2007 05:31PM
rPath Update Announcements (announce-noreply rpath com)
rPath Security Advisory: 2007-0096-1
Products: rPath Linux 1
Exposure Level Classification:
Indirect Non-deterministic Weakness
Previous versions of the shadow package have a weakness in the
useradd program; it may in some cases create new mail spool files
with a mode that may be vulnerable to reading and/or writing by
attackers with local system access. Note that, despite the clear bug
in the source code, we have seen no instances in practice of mail
spool files being created with insecure permissions. This update
will not fix permissions on existing system mailbox files, since it
is not possible to determine if any particular set of permissions
was chosen intentionally. Mail spool files are normally mode 660.
Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html
[ reply ]
Copyright 2010, SecurityFocus