Bug 77460 - Security breach - Root password can be changed by normal user
Security breach - Root password can be changed by normal user
Product: Red Hat Linux
Classification: Retired
Component: gnome-desktop (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Mark McLoughlin
: Security
Depends On:
  Show dependency treegraph
Reported: 2002-11-07 09:18 EST by Frank Weber
Modified: 2008-05-01 11:38 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2002-12-13 21:55:34 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Frank Weber 2002-11-07 09:18:51 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.1) Gecko/20020830

Description of problem:
an ordinary user can change the root password when he chooses 'system settings'
and 'root password'

Note: we have installed the group package 
- System Group : all
- Server Group : Server Configuration Tool

Version-Release number of selected component (if applicable): 8.0

How reproducible:

Steps to Reproduce:

1.GNOME Menu
2.'system settings' 
3.and 'root password'

Actual Results:  the normal user could change the root password

Expected Results:  Well, a normal user should not be able to change the root

Additional info:
Comment 1 Havoc Pennington 2002-11-07 11:23:47 EST
You have to type the current root password first, though. 

Note that if you authenticate for one of the "system settings" items the
authentication will be remembered for a few minutes, so you can run any of the
other items. The panel "notification area" should display an icon while you are
authenticated. You can run "pam_timestamp_check -k root" or click the icon 
to drop the authentication. See "man pam_timestamp" and "man pam_timestamp_check"

Please confirm that you are asked to type the current root password, 
unless authentication is currently timestamped.
Comment 2 Havoc Pennington 2002-12-13 21:55:34 EST
assuming NOTABUG

Note You need to log in before you can comment on or make changes to this bug.