Bug 927922
| Summary: | root account accessible without password when administrator user is created but no root passwd set | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jan Stodola <jstodola> | ||||||||||||||
| Component: | anaconda | Assignee: | Anaconda Maintenance Team <anaconda-maint-list> | ||||||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||||||
| Severity: | high | Docs Contact: | |||||||||||||||
| Priority: | high | ||||||||||||||||
| Version: | 19 | CC: | anaconda-maint-list, awilliam, g.kaviyarasu, jonathan, mkolman, petersen, robatino, satellitgo, sbueno, sstsalazar, vanmeeuwen+fedora | ||||||||||||||
| Target Milestone: | --- | ||||||||||||||||
| Target Release: | --- | ||||||||||||||||
| Hardware: | All | ||||||||||||||||
| OS: | Linux | ||||||||||||||||
| Whiteboard: | |||||||||||||||||
| Fixed In Version: | anaconda-19.23-1 | Doc Type: | Bug Fix | ||||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||||
| Clone Of: | Environment: | ||||||||||||||||
| Last Closed: | 2013-05-13 17:14:01 UTC | Type: | Bug | ||||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||||
| Documentation: | --- | CRM: | |||||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||
| Embargoed: | |||||||||||||||||
| Bug Depends On: | |||||||||||||||||
| Bug Blocks: | 834088 | ||||||||||||||||
| Attachments: |
|
||||||||||||||||
|
Description
Jan Stodola
2013-03-26 14:08:17 UTC
Created attachment 716532 [details]
anaconda.log
Created attachment 716533 [details]
anaconda.packaging.log
Created attachment 716534 [details]
anaconda.program.log
Created attachment 716535 [details]
anaconda.storage.log
Created attachment 716536 [details]
passwd
Created attachment 716537 [details]
syslog
I just reproduced this too with TC3. Proposing as an Alpha blocker since I think we really should not ship even Alpha with this kind of vulnerability present. Root login should be disabled if no root passwd is setup by anaconda. Discussed at 2013-04-03 blocker review meeting: http://meetbot.fedoraproject.org/fedora-blocker-review/2013-04-03/f19alpha-blocker-review-4.2013-04-03-16.01.log.txt . Rejected as a blocker: we just don't see this as serious enough. Alpha is not meant to be deployed in any kind of production scenario. You can't log in via ssh to a password-less account, hence this isn't (obviously) remotely exploitable. You still have to manually decide not to enter a root password and then create an admin user to cause this. It's a bug, yeah, but it doesn't hit any criteria and no-one seemed particularly keen to make it a blocker. Accepted as a freeze exception bug, though: it's always nice to fix security issues if the fix isn't too invasive. (Still true for TC4) Reproduced in TC6. anaconda-19.23-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/anaconda-19.23-1.fc19 Re-proposing as Beta FE, just in case, since it was Alpha FE (but we should get this fixed before freeze hits anyway). Package anaconda-19.23-1.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing anaconda-19.23-1.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-7049/anaconda-19.23-1.fc19 then log in and leave karma (feedback). anaconda-19.24-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/anaconda-19.24-1.fc19 Retested with F19-Beta-TC3 (anaconda-19.24-1). If no root password is entered during installation, root is not able to login later on installed system. Moving to VERIFIED. 19.25 went stable; closing. |