WARN: Ubuntu Admin Password Leak

furfurdemon666 · 03-12-2006, 10:32 AM

Would you want your Admin password in plain text on your hard drive readable by any user?

If you're using Ubuntu Breezy, this post on the Ubuntu Forums may be of interest.

In short, a user posted about the admin username/password being readable by any user in plain text in the file:

/var/log/installer/cdebconf/questions.dat

Check your own system and see for yourself.

Edit: See also: "Bug #34606 in Ubuntu: "Administrator root password readable in cleartext on Breezy"

Comments?

uselpa · 03-12-2006, 10:43 AM

Same on Kubuntu. And file is world-readable.
Well done...

Hangdog42 · 03-12-2006, 11:56 AM

Hmm. It isn't quite as straightforward as that. I support a couple of Ubuntu boxes for friends (both Breezy Badger) and while the admin username is in that file, the passwords definitely are not. Both are pretty stock installs of Ubuntu with very little customization. There has got to be a bit more to this story.

furfurdemon666 · 03-12-2006, 01:26 PM

Quote:

Originally Posted by Hangdog42

Hmm. It isn't quite as straightforward as that

Actually, for many people, it is. In fact, this bug has been confirmed and is listed as critical:

https://launchpad.net/distros/ubuntu/+bug/34606

scuzzman · 03-13-2006, 09:06 AM

This bug has been fixed. This post on the Ubuntu forum indicates that it was a problem in the install process that has not only been fixed in the upcoming Dapper Drake release, but there is a patch already available. To update yourself, simply install the latest version of passwd (passwd-4.0.3-37ubuntu8).

Capt_Caveman · 03-13-2006, 05:35 PM

A potentially critical vulnerability has been identified in Ubuntu 5.10 (Breezy Badger). The Ubuntu installer stores in plaintext the username and password of the first user created during installation in a world-readable file. As this user is granted full sudo rights by default, the account has administrative privileges. It has also been reported that the actual root password will appear if the installation was performed in 'expert mode'. Some uncertainty regarding the significance of this bug has led some vulnerability reports to classify it as minor, however it does appear to allow compromise of an administrative account by a local user.

http://secunia.com/advisories/19200/
http://www.securityfocus.com/brief/161
http://www.ubuntu.com/usn/usn-262-1
http://www.ubuntuforums.org/showthread.php?t=143334

Capt_Caveman · 03-13-2006, 05:45 PM

Thanks for reporting this. Merging this thread with the stickied post.