OSVDB ID: 23868 Title: Ubuntu Installer Log File Cleartext Password Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
The Ubunto installer contains a flaw that may lead to an unauthorized password exposure. The installer log files fail to sanitize passwords used during the installation. The installer log files are world-readable, thus any local user can see the password of the first user account, which has full sudo privileges by default, thus leading to a loss of confidentiality. |
Classification |
Location:
Local Access Required
Attack Type: Cryptographic, Information Disclosure Impact: Loss of Confidentiality Exploit: Exploit Public, Exploit Commercial Disclosure: OSVDB Verified |
Solution |
Upgrade package base-config to version 2.67ubuntu20 and passwd to version 1:4.0.3-37ubuntu8 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|