Bug 13137 - "cannaserver" daemon running by default
Summary: "cannaserver" daemon running by default
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: basesystem
Version: 7.1
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Bill Nottingham
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2000-06-27 22:59 UTC by Chris Evans
Modified: 2014-03-17 02:14 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2000-07-08 22:55:48 UTC
Embargoed:

Attachments (Terms of Use)

Description Chris Evans 2000-06-27 22:59:15 UTC 
Did a full install of BETA2, and rebooted.
A process called "cannaserver" was running as root, and listening on a TCP
socket :-(
This is obviously very dangerous.
I fully expect to find specific security issues with "cannaserver". I'll
update the bug tomorrow if I get time to take a look.
Comment 1 Chris Evans 2000-07-08 22:55:46 UTC 
Hmm - well, I haven't yet had the time to look at "cannaserver"
However, surprise surprise, Canna just got a few mentions on bugtraq for a
remotely exploitable problem (Debian have issued a security update).
Looks like "cannaserver" is as big a potential security disaster as "jserver"
Comment 2 Bill Nottingham 2000-07-15 18:24:22 UTC 
It is no longer running as default, and is set up only to listen locally
by default as of 3.5b2-19.
Comment 3 Chris Evans 2000-07-17 23:35:08 UTC 
Nice one. Note that #13133 is similar but more serious.
Note You need to log in before you can comment on or make changes to this bug.