Bug 13137

Summary:	"cannaserver" daemon running by default
Product:	[Retired] Red Hat Linux	Reporter:	Chris Evans <chris>
Component:	basesystem	Assignee:	Bill Nottingham <notting>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.1	CC:	notting, pbrown, rvokal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2000-07-08 22:55:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chris Evans 2000-06-27 22:59:15 UTC

Did a full install of BETA2, and rebooted.
A process called "cannaserver" was running as root, and listening on a TCP
socket :-(
This is obviously very dangerous.
I fully expect to find specific security issues with "cannaserver". I'll
update the bug tomorrow if I get time to take a look.

Comment 1 Chris Evans 2000-07-08 22:55:46 UTC

Hmm - well, I haven't yet had the time to look at "cannaserver"
However, surprise surprise, Canna just got a few mentions on bugtraq for a
remotely exploitable problem (Debian have issued a security update).
Looks like "cannaserver" is as big a potential security disaster as "jserver"

Comment 2 Bill Nottingham 2000-07-15 18:24:22 UTC

It is no longer running as default, and is set up only to listen locally
by default as of 3.5b2-19.

Comment 3 Chris Evans 2000-07-17 23:35:08 UTC

Nice one. Note that #13133 is similar but more serious.