|
|
>> Ubuntu Security Update Fixes Installer Local Password Disclosure Vulnerability
|
Title : Ubuntu Security Update Fixes Installer Local Password Disclosure Vulnerability
VUPEN ID : VUPEN/ADV-2006-0927
CVE ID : CVE-2006-1183
Rated as : Moderate Risk 
Remotely Exploitable : No
Locally Exploitable : Yes
Release Date : 2006-03-13
|
A vulnerability has been identified in Ubuntu, which could be exploited by local attackers to obtain elevated privileges. This flaw is due to an error in the installer that fails to clean passwords in certain world-readable log files (e.g. /var/log/installer/cdebconf/questions.dat), which could be exploited by local users to see the password of the first user account, which has full sudo privileges by default.
Affected Products
Ubuntu 5.10
Solution
Upgrade the affected package to version 2.67ubuntu20 (base-config) and 1:4.0.3-37ubuntu8 (passwd).
References
http://www.vupen.com/english/advisories/2006/0927
http://www.frsirt.com/english/reference/7636
Credits
Vulnerability reported by Karl Oie
ChangeLog
2006-03-13 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
