Bug 3045 - Installer gives root access to existing Linux installation
Summary: Installer gives root access to existing Linux installation
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: installer
Version: 6.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: David Lawrence
QA Contact:
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 1999-05-25 17:13 UTC by michael
Modified: 2008-05-01 15:37 UTC (History)
0 users

(edit)
Clone Of:
(edit)
Last Closed: 1999-05-25 17:56:58 UTC


Attachments (Terms of Use)

Description michael 1999-05-25 17:13:42 UTC
I have a Win95/Linux system and I discovered purely by
accident a security bug in the installer that gives you root
access to an existing Linux installation.  If you run the
installer (from autoboot.bat) up to the point where it gives
you a choice between installing a new system and upgrading,
you can get root access by switching to vitrual terminal 2.
 It's already logged in at a bash prompt there.

Comment 1 David Lawrence 1999-05-25 17:56:59 UTC
That is normal. Just dont let someone run the installation on your
personal system if you have sensitive information. You dont even have
to run the installation to get root access on a machine if they have
direct access to the server. That is why most sensitive servers are
kept in a locked room or closet.


Note You need to log in before you can comment on or make changes to this bug.