Date: Wed, 24 Oct 2007 23:43:02 +0200
From: Raphael Marichez <falco@gentoo.org.>
To: gentoo-announce@gentoo.org
Subject: [ GLSA 200710-25 ] MLDonkey: Privilege escalation
Message-ID: <20071024214302.GG2915@falco.falcal.net.>
Mail-Followup-To: gentoo-announce@gentoo.org,
bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk,
security-alerts@linuxsecurity.com
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="rWhLK7VZz0iBluhq"
Content-Disposition: inline
X-Web: http://falco.bz/
X-GPG-fingerprint: 04EB 153A 6B28 3E80 87A9 9B4F A77C 4BDE 021C 5BD2
X-GPG-Key: http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x021C5BD2
Organization: Gentoo Linux Security Team
User-Agent: Mutt/1.5.16 (2007-06-09)
X-Virus-Scanned: antivirus-gw at tyumen.ru
--rWhLK7VZz0iBluhq
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200710-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: MLDonkey: Privilege escalation
Date: October 24, 2007
Bugs: #189412
ID: 200710-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
The Gentoo MLDonkey ebuild adds a user to the system with a valid login
shell and no password.
Background
==========
MLDonkey is a peer-to-peer filesharing client that connects to several
different peer-to-peer networks, including Overnet and BitTorrent.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-p2p/mldonkey < 2.9.0-r3 >= 2.9.0-r3
Description
===========
The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so
that the MLDonkey service can run under a user with low privileges.
This user is created with a valid login shell and no password.
Impact
======
A remote attacker could log into a vulnerable system as the p2p user.
This would require an installed login service that permitted empty
passwords, such as SSH configured with the "PermitEmptyPasswords yes"
option, a local login console, or a telnet server.
Workaround
==========
See Resolution.
Resolution
==========
Change the p2p user's shell to disallow login. For example, as root run
the following command:
# usermod -s /bin/false p2p
NOTE: updating to the current MLDonkey ebuild will not remove this
vulnerability, it must be fixed manually. The updated ebuild is to
prevent this problem from occurring in the future.
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200710-25.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--rWhLK7VZz0iBluhq
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iQEVAwUBRx+8ZjvRww8BFPxFAQIDxQf/f7tBC5ZD3Jvlh7x7l4wUMoS5vstbFpys
wA3Vkz4yeYs5hB8htKBAVkrMeyWZGDQpr+wUtbVrW6fMZZDuAOpKHzYbr2ZIi9vd
ybBlNbz3/kl5cIm/agF6eWkQqOqWHdV5S38+ShXJfvzqBKCG1I81N5wOrglyTKXG
BwlWjp8GRCN99o/AFNr6B9AhYOVKkC7MBwt/LOYgnZXnAXUEO9sBSLtqdhZyGBeT
B14clHlNbq/ofDxG0elHbDlfJUHobFmjaonqf3O+AflPwLvNX1igKjQPFSBz9nEW
aRfxcfpeEpELEikp4UAU+2OkD9ZW5ISX79lhxVTYVC5VA58qL8A/0Q==
=hFis
-----END PGP SIGNATURE-----
--rWhLK7VZz0iBluhq--
