Bug 13137 - "cannaserver" daemon running by default
Summary: "cannaserver" daemon running by default
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: basesystem   
(Show other bugs)
Version: 7.1
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Bill Nottingham
QA Contact:
URL:
Whiteboard:
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2000-06-27 22:59 UTC by Chris Evans
Modified: 2014-03-17 02:14 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-07-08 22:55:48 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Chris Evans 2000-06-27 22:59:15 UTC 
Did a full install of BETA2, and rebooted.
A process called "cannaserver" was running as root, and listening on a TCP
socket :-(
This is obviously very dangerous.
I fully expect to find specific security issues with "cannaserver". I'll
update the bug tomorrow if I get time to take a look.
Comment 1 Chris Evans 2000-07-08 22:55:46 UTC 
Hmm - well, I haven't yet had the time to look at "cannaserver"
However, surprise surprise, Canna just got a few mentions on bugtraq for a
remotely exploitable problem (Debian have issued a security update).
Looks like "cannaserver" is as big a potential security disaster as "jserver"
Comment 2 Bill Nottingham 2000-07-15 18:24:22 UTC 
It is no longer running as default, and is set up only to listen locally
by default as of 3.5b2-19.
Comment 3 Chris Evans 2000-07-17 23:35:08 UTC 
Nice one. Note that #13133 is similar but more serious.
Note You need to log in before you can comment on or make changes to this bug.