Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Root Password Readable in Clear Text with Ubuntu 520

Posted by Zonk
from the that's-a-big-oops dept.
BBitmaster writes "An extremely critical bug and security threat was discovered in Ubuntu Breezy Badger 5.10 earlier today by a visitor on the Ubuntu Forums that allows anyone to read the root password simply by opening an installer log file. Apparently the installer fails to clean its log files and leaves them readable to all users. The bug has been fixed, and only affects The 5.10 Breezy Badger release. Ubuntu users, be sure to get the patch right away."
This discussion has been archived. No new comments can be posted.

Root Password Readable in Clear Text with Ubuntu

Comments Filter:
  • Open source (Score:5, Funny)

    by L505 (884811) on Monday March 13, 2006 @12:38AM (#14905312) Homepage
    What's the problem? Open source passwords make it more secure.
    • by Anonymous Coward on Monday March 13, 2006 @12:44AM (#14905339)
      Information wants to be free
    • by aurb (674003) on Monday March 13, 2006 @12:49AM (#14905362)
      Contribute to Open Password comunity - release your passwords under the GPP (General Public Password) license! Because closed passwords are just series of * symbols - it's hard to use, share and modify them freely. :-)
      • by AuMatar (183847) on Monday March 13, 2006 @01:12AM (#14905420)
        But my root password really is ********. I mean really, who the hell is going to guess that?
        • Re:Open Password! (Score:5, Interesting)

          by Brandybuck (704397) on Monday March 13, 2006 @01:21AM (#14905438) Homepage Journal
          I actually used ***** as a backdoor password for a system I once worked on. Really! The service department demanded a backdoor password to give the service people, so that they wouldn't be calling in all the time for passwords. I fought and fought, but the lure of a continuing paycheck was too much, so I finally relented. My second choice was eight spaces.
        • by L505 (884811) on Monday March 13, 2006 @01:31AM (#14905475) Homepage
          Using special characters not available on the keyboard is another strong security measure..

          Many people know how to generate these special characters but I'll mention anyway: using the ALT/META key and the NUMPAD keys. Having a character map printout handy so you know the DEC (decimal) values of these special characters is a good idea if you decide to implement one of these passwords. Punch in ALT-DecimalValue with number lock on.

          They may not work in some situations if special characters and not allowed, but you'd be surprised that they do work most often.

          I bet most dictionary attacks don't run through many special characters. The cracker is lazy too and will probably not even consider that you chose a funny character which does not even exist on the keyboard.

          Remember not to use NULL (#0) though, for crying out loud.

          • by Anonymous Coward
            ...still more proof that NUL-terminated strings are the work of the devil. C'mon -- give up two bytes at the front of the string to tell how long the damned thing is. It's not fucking 1974 where the loss of a couple of bytes is gonna crap out the system. Prepend the length -- and reserve a value like 0xFFFF to mean "at the end of this string find another string with its own length encoded there..." -- Yes, I know, there's the potential for collision with a string that's actually 0xFFFF bytes long - but hey,
            • Only two bytes? That's a limitation of 65536 chars -- not that much really when you think about it. For crying out loud, we have 64-bit processors now. Please, let's think of the future, and reserve eight bytes for string length -- just in case somebody ever wants to put the entire addressable space into a scalar.
          • Those of you who have been doing the online thing a long time might recall an old BBS door game called "Time of Chaos [wwiv.com]". In that game, you could have a base with a passcode for the door, but opponents could buy a piece of gear that allowed them to make an attempt to crack your passcode.

            The game would show the passcode as a series of periods ("."), replacing a random number of them with the actual codes. By using several of these devices, you could get several or all of the characters in the passcode by rep
        • Re:Open Password! (Score:3, Informative)

          by Asic Eng (193332)
          But my root password really is ********. I mean really, who the hell is going to guess that?

          Dunno - presumably it's long been in any password cracker out there? Along with "none" or "password" or any other "clever" password there is?

    • Yes, exactly. If someone screws up your system, somebody else will come along and fix it for you. The many eyes make all bugs shallow or something. Think of it as a Wiki-style OS security.
    • Solution (Score:5, Informative)

      by itismike (582070) on Monday March 13, 2006 @01:25AM (#14905452)
      1. open a terminal and type:
        sudo apt-get update
      2. wait for it to finish
      3. click the Red update icon in the upper-right corner
      4. click through the update
      5. locate the file and verify that it is unreadable by a non-privileged user
      • Re:Solution (Score:5, Insightful)

        by 1u3hr (530656) on Monday March 13, 2006 @02:22AM (#14905605)
        1. Change your password.

        (Only passwords used during the install are written to the file in question.)

    • Just another demonstration of the failure of security through obscurity!
  • Saw this on Digg (Score:3, Insightful)

    by Stevyn (691306) on Monday March 13, 2006 @12:38AM (#14905314)
    It came out, it was fixed. There are going to be problems in any project this large, but it shows how much the Ubuntu team cares to respond to a problem this quickly and on a Sunday of all days. Ubuntu really has become a nice distro. It's completely free and polished around the edges. I hope they continue to do well.
    • by Anonymous Coward on Monday March 13, 2006 @12:42AM (#14905328)
      Oh PLEASE, what a joke of a comment. The fact is, they fucked up BIG TIME. Yeah, it's a nice distro, but so is windows, and had microsoft made this error you'd be on their ass about how crappy windows is.

      The bias here on slashdot sometimes makes me sick.

      Grow up people!
      • People make mistakes. The folks at ubuntu were nice enough to release a 0-day patch. While it isn't as good as never having the vulnerability in the first place, it is the next best thing.
        • by Bacon Bits (926911) on Monday March 13, 2006 @01:01AM (#14905395)
          Nevertheless, AC is right. If it was relvealed that the local Administrator account or the domain Administrator account was stored anywhere as plain text in Windows 2000, XP, or 2003, then MS would be reamed endlessly and very harshly here. Or do you honestly think people would be saying "oh, well, at least MS has a patch!" I'm no fan of Microsoft as a company, but denying that a bias exists on Slashdot about this kind of thing -- apologising for *nix, criticising Windows -- is just outright absurd.

          Be honest. Everyone here knows that storing the root password as plain text is a clear program error. And since GNU/Linux is a rather secure OS that doesn't have this vulerability in any other distro, this code was added by the Ubuntu team. If this is the quality of code that the Ubuntu team is developing for it's distro, though, I do have to question why it is so popular. Why was such an obvious mistake missed? Who forgot to check how the root password is stored? Who forgets that kind of thing? Not the kind of developer I'd want to trust with my security, I'll tell you what.

          • Re:Saw this on Digg (Score:5, Interesting)

            by xlsior (524145) on Monday March 13, 2006 @01:25AM (#14905450) Homepage
            Nevertheless, AC is right. If it was relvealed that the local Administrator account or the domain Administrator account was stored anywhere as plain text in Windows 2000, XP, or 2003, then MS would be reamed endlessly and very harshly here.

            Interestingly enough Microsoft did make pretty much the same mistake, with Microsoft SQL 7, both servicepack 1 & 2. They wrote the SQL administrator password to the installation log file, which would give you full access to any SQL database on the server. Written to a logfile in the TEMP folder, which by default has full read/write access for any user on the system.

            Security bulletin: https://www.microsoft.com/technet/security/bulleti n/MS00-035.mspx [microsoft.com]

            (The 'non-recommended' mode mentioned is using SQL authentication instead of windows NTLM authentication, which much more common then they try to make it sound)
            • Re:Saw this on Digg (Score:5, Informative)

              by xlsior (524145) on Monday March 13, 2006 @01:30AM (#14905468) Homepage
              Actually slightly more elaborate: SQL 7 SP3 was also affected, plus they wrote the password to not one, but two files:

              Summary
              On May 30, 2000, Microsoft released the original version of this bulletin, to announce the availability of a patch that eliminates a security vulnerability in Microsoft® SQL Server® 7.0 Service Packs 1 and 2 installation routine. When run on a machine that is configured in a non-recommended mode, the routines record the administrator password in a log file, where it could be read by any user who could log onto the server at the keyboard.

              On June 15, 2000, the bulletin was updated to note that, under the same conditions as originally reported, the password also is recorded in a second file. A new version of the patch is available that prevents the password from being recorded in either file.

              On May 10, 2001, the bulletin was updated to note that Service Pack 3 is also affected by this vulnerability. A new patch is available for SP3 and we are also providing a command line utility (post Service Pack deployment) to remove all instances of the SA password written in either file via Q263968.



              So not only did they have a similar problem, it persisted for over a year after initially being found & alledgedly fixed.
          • by Canordis (826884) on Monday March 13, 2006 @02:53AM (#14905698)

            This is a consequence of Ubuntu's different security model. You can't be root in Ubuntu; you have to consciously make the decision to run software as root by typing 'sudo' before it. (Actually you can run a shell under sudo, but still.) The idea was that since you can't login as root, the system is more secure and resists exploits that try to gain root access. This vulnerability is the kind of stupid mistake people make sometimes. A brain fart. Nothing really malicious, and not the sign of an incompetent programmer. Something you could've done.

            Most Windows vulnerabilities are that, too. There's just more of them. And the system is inherently less secure, so it doesn't resist those quite as well. And it's harder to update because it's a monolithic kludge. Of course, some Windows vulnerabilities are just the product of poor design.

            And another thing, if this happened, /. would bash Microsoft insanely. True. There is a bias. But still, I highly doubt the issue would be fixed in the same day, on a Sunday, and the update would be availiable quickly and painlessly.

            • Re:Saw this on Digg (Score:5, Interesting)

              by wertarbyte (811674) on Monday March 13, 2006 @03:05AM (#14905740) Homepage

              You can't be root in Ubuntu; you have to consciously make the decision to run software as root by typing 'sudo' before it. (Actually you can run a shell under sudo, but still.) The idea was that since you can't login as root, the system is more secure and resists exploits that try to gain root access. This vulnerability is the kind of stupid mistake people make sometimes.

              There is another stupid vulnerability I noticed in Ubuntu, which relates directly to the missing root password: If something goes wrong during system startup (e.g. a failed fsck), usually you are prompted for the root password to open the rescue console and fix the issue. Not so with Ubuntu: Since there is not root password, you will be thrown into a root shell without any hesitation. Kind of strange, is it? One could argue that once you have physical access to the system, you have a lot of possibilities to circumvent the system's security, but I found this issue to be rather harsh.

      • by Parham (892904) on Monday March 13, 2006 @12:54AM (#14905379)
        If Microsoft had made the error, we'd have to wait until the second Tuesday of the month for the fix. If this bug wasn't caught by tomorrow for me, then I'd have to wait an entire month for a fix. Ubuntu put out the patch as soon as it was discovered. There is no bias here, I use Windows just as much as Linux. However, Microsoft's patching cycles simply suck.
        • by RzUpAnmsCwrds (262647) on Monday March 13, 2006 @01:08AM (#14905409)
          If Microsoft had made the error, we'd have to wait until the second Tuesday of the month for the fix. If this bug wasn't caught by tomorrow for me, then I'd have to wait an entire month for a fix. Ubuntu put out the patch as soon as it was discovered. There is no bias here, I use Windows just as much as Linux. However, Microsoft's patching cycles simply suck.

          Patching is quite frankly irrelivent with this bug. While it certainly has to be done to close the hole in the future, there are already hundreds of thousands of Ubuntu systems out there with the password sitting on the disk. How are you to be sure as an administrator that the password has not been compromised already? What about backup copies that might have the password?

          The fix is to change the administrator/root password. The bug only affects a system at install-time, and it will continue to affect new installs so long as the broken installer is floating around. Patching it today is hardly more effective than patching it on April 6.
          • The bug only affects a system at install-time, and it will continue to affect new installs so long as the broken installer is floating around. Patching it today is hardly more effective than patching it on April 6.

            It's been a while since I installed an Ubuntu system, but I believe that during the install you have the option of instaling updates. If you refuse, once you're logged in you'll see the red icon saying updates are available. At that point, it's the user's fault if the file with the PW is sti

            • by LnxAddct (679316) <sgk25@drexel.edu> on Monday March 13, 2006 @02:28AM (#14905617)
              Why the hell is everyone trying to downplay the severity of this? This is a serious issue, its worse than most security problems I've seen with *any* operating system, stop the hand waving, and spread the word instead. This *is* serious and shows poorly on the Ubuntu developers. I mean, how many people have set up linux for their parents or family, chosen Ubuntu and now they have to make sure they go in and change that. Updating won't always work (for reasons listed elsewhere), the only sure thing to do is to physically change it (if ssh access is enabled than its easier).

              One of Ubuntu's big things is giving out free cd's, in particular targeted to people who don't know what linux is. Me and my roommates actually had a 100 or so Ubuntu CDs, most of which we've given away. We both run Fedora, it fits our needs as "powerusers" better, but give out Ubuntu simply out of convenience and to help the "cause". They are both nice distros, but security is definitely one area where Fedora surpasses all of the other distros.

              Fedora makes security transparent to the user, you're running SELinux but would never know it unless you needed to, you're running exec-shield but you'd never know it unless you needed to, all the major services are compiled to randomize memory mappings, but the user is none-the-wiser. That goes for advanced and beginning users. I can install Fedora and be fairly certain that even if somehow my system stopped updating, that any vulnerabilities found would be stopped by these additional measures anyway. The measures in place make most buffer overflows useless and even if you somehow got passed all of the measures to prevent overflows and you got root through an exploit in a vulnerable service (despite that the services don't run as root), SELiux would probably still make your entry pretty pointless.

              The point I'm making is, the differece between a secure OS a non-secure OS are ones where even without updates, the security measures in place are foward looking and work to prevent current unknown attacks. Fedora has damn near perfected this, but if any of the users of the Ubuntu CDs I've given out somehow managed to disable updates, they are screwed now. There should never be a situation like that. Bravo on the response time, but seriously the users most likely to be affected don't read /. or digg and if they don't update then they are screwed more than they were before. I don't like knowing that a local user vulnerability will can give out root access
              Regards,
              Steve
              • Re:Saw this on Digg (Score:3, Informative)

                by kasperd (592156)
                Fedora makes security transparent to the user, you're running SELinux but would never know it unless you needed to, you're running exec-shield but you'd never know it unless you needed to
                But occationally it gets the file labels fucked up causing things to stop working. The Fedora people refuse to acknowledge there is a bug, after all you can just touch /.autorelabel and reboot.

                all the major services are compiled to randomize memory mappings, but the user is none-the-wiser.
                If you had actually been usin
        • Re:Saw this on Digg (Score:5, Informative)

          by drsmithy (35869) <drsmithy&gmail,com> on Monday March 13, 2006 @01:44AM (#14905516)
          However, Microsoft's patching cycles simply suck.

          Actually they reflect reality and are the result of customer requests.

          In managed environments, patches are almost never applied ad-hoc, as they are released. They are collected together then tested and rolled out on a schedule, usually monthly.

    • Re:Saw this on Digg (Score:4, Interesting)

      by MobileTatsu-NJG (946591) on Monday March 13, 2006 @01:23AM (#14905445)
      "It came out, it was fixed. There are going to be problems in any project this large, but it shows how much the Ubuntu team cares to respond to a problem this quickly and on a Sunday of all days. Ubuntu really has become a nice distro. It's completely free and polished around the edges. I hope they continue to do well."

      I know this rationale gives everybody the warm fuzzies, but this is still a really bone-headed mistake. You guys really shouldn't be this forgiving about it.
  • by ergo98 (9391) on Monday March 13, 2006 @12:42AM (#14905330) Homepage Journal
    Invariably, a lot of the comments to this story are going to commend the team on the incredibly speed with which they've released a patch, and there'll probably be some comments comparing it to closed software. Yet another victory for the open source model!

    Yet how long has this massive fault been sitting there waiting for the first person to discover it? How do we know that the public acknowledgement of it was the first actual discovery of it?

    I believe Breezy was released in October, so for five months install logs have been sitting, world-readable, often with the root password. Surely in that time someone well less savoury motives did a simple grep of an install looking for the most trivial of faults.

    Feeling confident in the speed of the patch relies upon the belief that no one with nefarious motives discovered it before a benevolent bug submitter did.
    • Awesome (Score:2, Insightful)

      by ergo98 (9391)
      30 seconds and my post got a flamebait. I love Slashdot.

      Within the same 30 seconds a post appeared following mine comparing the fix (which has the massive complexity of deleting some log files) with Microsoft's WMF fix, exactly as predicted. Beautiful, and so predictable.
      • Yeah, and the WMF bug I can understand --- it's legacy code written back in a time when no one cared about security. Leaving the root password in a plaintext file, though, is a colossal, inexcusable fuckup, and I don't care that they fixed it quickly. Whoever designed that installer should be ashamed of themselves.
    • by MichaelSmith (789609) on Monday March 13, 2006 @12:53AM (#14905373) Homepage Journal
      I believe Breezy was released in October, so for five months install logs have been sitting, world-readable, often with the root password. Surely in that time someone well less savoury motives did a simple grep of an install looking for the most trivial of faults.

      Anybody with an ounce of common sense should know that you never leave a critical password floating around in plain text. Not in memory, not in swap and you never print it to a bloody log file. Who's going to want to check it?

      Passwords are supposed to be non-reversable. The NetBSD installer seems to run the passwd command directly during installation, so the installer never sees the password. Did somebody get the bright idea of prompting for the password in their own UI when the graphical installer was done? This should have been caught. The design of the installer is at fault. Not the log file. I wouldn't count this one as fixed until the installer never sees the password. Sorry for the rant.

      • The design of the installer is naturally at fault. The way it works currently is it stores the answers to a bunch of questions asked during install, and then feeds them into the install system. If the answers list was simply a log, the easy fix would have happened ages ago: simply don't output the password to the file. Clearly the system is using that to send to the create first user script. That script is supposed to remove that entry, but it appears to have temporarily broken. I gather its generally usefu
  • windows (Score:3, Funny)

    by Chimera512 (910750) on Monday March 13, 2006 @12:45AM (#14905341) Homepage
    see this is why i use windows. there are never security patches to install, just service packs which allow me to get new secutiry features like windows firewall. nothing beats windows security, and there's that helpful blue screen to tell me if something's gone wrong.
  • by Anonymous Coward on Monday March 13, 2006 @12:46AM (#14905346)
    Fuuuuck.

    I knew I never should have trusted those badgers.

    Smiling at me with their big cartoon teeth, eating up all the aspen, wanting to admin their own machines.

    I've been a sap, and it's going to cost me.

    And now I'm worried about the hedgehogs.
  • This IS a very serious issue, however it does require some work (accessing log) to obtain root. In comparison to other operating systems which provide default root ("administrator") access, without a password, on installation; this isn't as big of a deal. On top of this, from my understanding, a change of the root password after installation would prevent further issues. Overall this seems to be a problem but certainly not a huge one.
    • by damiam (409504) on Monday March 13, 2006 @01:34AM (#14905484)
      In comparison to other operating systems which provide default root ("administrator") access, without a password, on installation; this isn't as big of a deal.

      WTF are you smoking? No modern OS sets up an unpassworded root account by default, especially on a multiuser system. And if they did, there would be no expectation of security. Here, there is the expectation of security, and it is violated.

      In fact, this attack is even worse than the average privilege escalation vulnerability, because a) it's amazingly stupid on the part of the programmer and b) the attacker gains not just root priveleges but the root password, which is often reused by less-paranoid users for other purposes.

  • by zippity8 (446412) on Monday March 13, 2006 @12:48AM (#14905354)
    He patched it within hours today, and posted to osnews with a description of what happened. He also posted a copy on the ubuntu forums [ubuntuforums.org] page including details of what happened. It affects clean installs of breezy, and dapper upgrades from a breezy install, but not hoary or a clean dapper. hoary = 5.04 breezy = 5.10 dapper = not officially released yet
  • by Anonymous Coward on Monday March 13, 2006 @12:48AM (#14905359)
    Any programmer who doesn't stop themselves and think that writing something like fprintf(logfile, "root password entered is: %s\n", password); is not the best idea should not be writing code for a secure operating system.
    • by SuperBanana (662181) on Monday March 13, 2006 @01:35AM (#14905489)
      Want another example of Debian/Ubuntu idiocy?

      The netatalk package, which provides Appletalk services (most commonly used servies are AFP, ie filesharing, and papd, the printing spooler), isn't compiled in with ANY encrypted password support. If you connect to a debian or debian-based appletalk fileserver, you get a warning you are transmitting your password in clear-text. Yes, we're jumping about 10 years BACKWARDS in security.

      Why? Because the legal-circle-jerk that is the debian-legal mailing list, decided that it wasn't "legal" to link netatalk (a GPL project) to OpenSSL (license supposedly incompatible with GPL.) This doesn't stop every other distribution on the planet from compiling netatalk with openssl, and hence supporting encrypted passwords.

      They politely suggested that GnuTLS, which isn't even remotely drop-in, be used instead. That was back in 2002...and the issue still hasn't been addressed. I filed a bug on it and the bug was simply ignored.

      • by SnowZero (92219) on Monday March 13, 2006 @02:09AM (#14905572)
        ...Why? Because the legal-circle-jerk that is the debian-legal mailing list, decided that it wasn't "legal" to link netatalk (a GPL project) to OpenSSL (license supposedly incompatible with GPL.

        This has been discussed at length, and OpenSSL's license is GPL incompatible. Everyone else may simply think it's ok to bend the rules, and that they won't ever get sued for it. That's not a safe assumption for a volunteer-based distribution.

        This doesn't stop every other distribution on the planet from compiling netatalk with openssl, and hence supporting encrypted passwords.

        "Everyone else breaks the rules, so its ok." That doesn't work for speeding tickets, and it doesn't work in contract/license disputes.

        They politely suggested that GnuTLS, which isn't even remotely drop-in, be used instead. That was back in 2002...and the issue still hasn't been addressed. I filed a bug on it and the bug was simply ignored.

        Maybe you and any other users of appletalk on unsecure networks ought to band together and fix it. Alternatively you can just switch distributions or upgrade your networking from appletalk (a 1980s protocol, since you were talking about being 10-years backwards).

        Does it suck? Yes. It sucks that the OpenSSL people won't change their license, and upstream netatalk doesn't care either. However Debian would risk legal action against ALL users if they break the law, even though 1% of the users use this package. They chose the solution for 99% of their users, which is the best you can hope for in an esoteric case like this.
        • Alternatively you can just switch distributions or upgrade your networking from appletalk (a 1980s protocol, since you were talking about being 10-years backwards).

          Secure password authentication in AFP was introduced at least 10 years ago. We're talking about AppleSHARE here, Mr. Genius. A protocol fully maintained and used extensively on current hardware. I'll switch to SMB when it offers the same level of performance as AFP (it doesn't, not even close, in raw transfer speed or directory operations) a

          • Licenses aren't a technical detail of Linux, it's the core. It's what makes them possible. If we decide to start ignorning them because they are inconvenient in some particur situation, we weaken the entire foundation of open source software.

            And anyway, you may find in this post-SOX world that administrators care a bit more about the legality of their software than you may think.
    • by strider44 (650833) on Monday March 13, 2006 @01:38AM (#14905505)
      Come now, do you really think that somewhere in the code there's a manual fprintf writing the root password to the file? You could have at least made a simple attempt at reading the article to find out what it's about and what causes it.

      The problem here is that the main user password (Ubuntu doesn't have a root password) is asked through the questions dialogue in the installer. Everything here is automatic and the questions dialogue just simply records everything down in a file called "questions.dat". It's a serious error for a programmer sure, but it's just a lack of thinking of everything when programming, which is what every single security hole is caused by, lets face it. You could just as easily say everyone who doesn't check their arrays every single time no matter what shouldn't be let within ten feet of gcc, but alas even the best make mistakes. Not only this, but someone who doesn't check every array may be letting through a remote exploit, which is much much more serious than this bug.

      The mantra of course applies here: Unless you've programmed a totally secure operating system, keep your mouth shut.
      • by arrrrg (902404) on Monday March 13, 2006 @02:11AM (#14905579)
        In the forum, it was mentioned that there was in fact code in the installer to go back and remove the sensitive information from "questions.dat" after the installer finished. A bug was introduced somewhere in this code in the breezy release, so the password never got removed. So, the error was not nearly as obvious as fprintf (password) or even dump(questions); an attempt was made to do the right thing. Of course, the working condition of this code should definately have been verified before releasing breezy, but both the parent and grandparent make the developers seem more negligent than is actually the case.
      • I have. My homebrew OS doesn't even compile. No security problems there.

        Joking aside, if you apply that little mantra of yours to other scenarios, you'll see how silly it is. How about "Don't criticise Gigli unless you've produced the perfect film"? How about "Don't criticise your plumber for not fixing your leak and flooding your basement until you've laid the perfect pipe"? How about "Don't criticise your goverment until you've ruled over the perfect society"?

        You do not need to be an expert to see when an
    • Agreed. (Score:3, Informative)

      by jd (1658)
      If the password needs to be temporarily stored, there are plenty of ways to store a password that are secure and fast. Besides, since you'll only ever actually check the password against a hashed value, it would be more logical to store the hash if you want the speed.

      For debugging purposes, you MAY want to print out entered values. However, you don't do this in the main log. For a start, if you're debugging, you don't want to have to search through tonnes of text. You want to find the error fast. You theref

    • In a real project, someone who made a greenhorn mistake like that would be fired. In Open Source, you just say "oopsie" and keep blundering forward.
  • by Anonymous Coward
    Ubuntu is poised to become to standard by which Linux distros are judged. I've been running the latest stable release, Breezy Badger 5.10 for awhile and it's rock solid, good looking, and easy to administer. Last night I downloaded Flight 5, the latest development iso for Dapper Drake 6.04, and was immediately impressed. In just one upgrade, they've managed to really go the extra mile with all the new features. I love minimalist simplicity, and Ubuntu gives me just that. Ubuntu is Debian made easy for the m
    • by MichaelSmith (789609) on Monday March 13, 2006 @01:31AM (#14905474) Homepage Journal
      Ubuntu is Debian made easy for the masses. You get the bullet-proof Debian core with a great, easy interface. Nothing touches this at the moment.

      I run Ubuntu on my laptop and FC4 on my workstation. Ubuntu is great for office type stuff: word processing and email. A surprising number of printers work out of the box.

      But I also want to use the laptop for development and here I have struck a few problems. Development libraries are not installed by default (fair enough) but I got into loops trying to install Motif development libraries thorugh apt. I tried to copmpile motif but hit significant dependency problems in the process.

      In general I don't think Ubuntu is suited to development work. I am considering dual booting the laptop with another OS for that purpose. But I do continue to recommend it to non-technical people who need to reinstall their systems.

  • I installed the beta of Breezy 5.10 and /var/log/installer/cdebconf/questions.dat *did not* contain my password. Looks like this only affected the final release.
  • by prockcore (543967) on Monday March 13, 2006 @01:18AM (#14905434)
    I find it very interesting that the severity of this bug is identical to the severity of the security hole found in OSX last week... yet the difference in attitudes is remarkable.

    Look at the slashdot summary. "An extremely critical bug and security threat". Compare with the OSX bug which was written off because it's not remotely exploitable.

    Apple hasn't even acknowledged that the OSX privilege escalation exists, let alone patched it.
  • by dartarrow (930250)
    open var/log/installer/cdebconf/questions.dat, check at line 2140. Mine is there, individual results may vary
  • by magi (91730) on Monday March 13, 2006 @01:25AM (#14905454) Homepage Journal
    Ubuntu users, be sure to get the patch right away.

    What does this patch fix? The installer? Sorry, but the installer is burned in the installation media, and a patch can be applied only after the installer has been run. So updating the system or even upgrading to Dapper (where it has been fixed) doesn't help. So....patch whAt???

    No really, the installation ISO images should be fixed immediately and redistributed.

    Also saying that it "only affects The 5.10 Breezy Badger release" may be a bit belittling, as probably most people have installed exactly that release.

    • What does this patch fix? The installer?


      No, the patch removes that key from the file, and chmod's it 600.
    • I actually picked up the 5.10 disks last week, and was thinking of installing it... glad I didn't.

      If the problem is in the installer which is only run once, am I correct in assuming that using a 'dummy' password during the install and changing it afterwards will leave only the dummy password on disk?

      I wish the Ubuntu people were a bit more proactive in their security, though.
      • I actually picked up the 5.10 disks last week, and was thinking of installing it... glad I didn't.

        You think that--within one week of installing--someone who already has a valid login to your machine would have 0wned your box using this security hole? What, was it a server or something?

        If it was just your desktop machine, then yeah, this is crappy, but it's hardly a disaster, and the odds are pretty good that not even one person running Ubuntu on a simple desktop machine was harmed by this at all.

        If the pro
  • by putko (753330)
    It is unimaginable that OpenBSD would ever have an error like this.
  • all these comments and noone has yet said it... ..ok...I'll do it, you've forced me..

    Is this a "badger hole"?

    Hey, someone *had* to say it. Laugh.

    Strat
  • by MarkByers (770551) on Monday March 13, 2006 @01:34AM (#14905486) Homepage Journal
    Don't use a bleeding edge home desktop OS if you want a secure multi-user server.
  • Whew! (Score:2, Funny)

    by cciRRus (889392)
    Good thing I'm using Windows.
  • Patch mirror (Score:3, Insightful)

    by atomic-penguin (100835) <wolfe21@mar[ ]ll.edu ['sha' in gap]> on Monday March 13, 2006 @02:06AM (#14905564) Homepage Journal
    #!/bin/sh
    PASS="my_root_password"

    echo "Why would anyone log a password in the installer?\n"
    find /var/log -type f -exec sed -i s/$PASS//g' {} \;

    echo "Why would anyone have /var/log readable by users?\n"
    chown -R root:root /var/log
    chmod -R o-rwx /var/log

    echo "All done, thanks for using Atomic-Penguin\'s unofficial ubutnu patch!\n"
  • by Pausanias (681077) <pausaniasxNO@SPAMgmail.com> on Monday March 13, 2006 @02:10AM (#14905573)
    I didn't find the password in my installer logs. It seems that if you install in expert mode you're OK. See the bug report here:

    https://launchpad.net/distros/ubuntu/+bug/34606 [launchpad.net]
  • Anybody who's done a breezy install and allowed any sort of remote or non-admin access should be changing their password .... NOW! .

    The patch (unless it goes out and deletes the offending files) is only going to patch the installer (which you're probably never going to run again). You're still going to have a cleartext copy of your original admin password sitting on the box in a file with read-other permissions.

    Even if the files get deleted (or have their permissions changed), you still have no idea as to whether somebody has read the files since October.

    BTW: Are they re-burning the installation CDs?

    • "The patch (unless it goes out and deletes the offending files) is only going to patch the installer (which you're probably never going to run again). You're still going to have a cleartext copy of your original admin password sitting on the box in a file with read-other permissions."

      I've been +5 wrong a few times. It's always a bit embarrassing. Stupid moderators. :)

      The fix does indeed fix the problem file. I applied it this morning, and afterwards the file in question (/var/log/debian-installer/cdebc

"The identical is equal to itself, since it is different." -- Franco Spisani

Working...