Possible Linuxconf Vulnerability

From: The Nefarious Type (prestochangoat_private)
Date: Thu Apr 29 1999 - 15:45:40 PDT

  • Next message: Paddy Duncan: "Re: Security Configuration Editor info"

    	
    	An older version of linuxconf was packaged with Redhat 5.1 and  I had
    not run into any problems with that version. But after installing the latest
    version (linuxconf-1.13r15-1) onto OpenLinux 1.3, I came upon a problem during
    boot. It had not detected /sbin/clock, so a menu appeared during boot and asked
    if I wanted to change this. This happened all before I was even prompted for a
    login.  	
    	The fact that someone who has physical access to the server can
    access linuxconf (which by default, can only be used under root) is kind of
    disturbing. So far, I have not been able to exploit this problem, though I'm
    guessing that it could be done (e.g. from that menu, access user configuration,
    etc.).
    
    Linuxconf Homepage
    http://www.solucorp.qc.ca/linuxconf/
    
    
    -PrestoChango
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:44:33 PDT