Bug 77460 - Security breach - Root password can be changed by normal user
Summary: Security breach - Root password can be changed by normal user
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: gnome-desktop
Version: 8.0
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Mark McLoughlin
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2002-11-07 14:18 UTC by Frank Weber
Modified: 2008-05-01 15:38 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2002-12-14 02:55:34 UTC

Attachments (Terms of Use)

Description Frank Weber 2002-11-07 14:18:51 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.1) Gecko/20020830

Description of problem:
an ordinary user can change the root password when he chooses 'system settings'
and 'root password'

Note: we have installed the group package 
- System Group : all
- Server Group : Server Configuration Tool

Version-Release number of selected component (if applicable): 8.0

How reproducible:

Steps to Reproduce:

1.GNOME Menu
2.'system settings' 
3.and 'root password'

Actual Results:  the normal user could change the root password

Expected Results:  Well, a normal user should not be able to change the root

Additional info:

Comment 1 Havoc Pennington 2002-11-07 16:23:47 UTC
You have to type the current root password first, though. 

Note that if you authenticate for one of the "system settings" items the
authentication will be remembered for a few minutes, so you can run any of the
other items. The panel "notification area" should display an icon while you are
authenticated. You can run "pam_timestamp_check -k root" or click the icon 
to drop the authentication. See "man pam_timestamp" and "man pam_timestamp_check"

Please confirm that you are asked to type the current root password, 
unless authentication is currently timestamped.

Comment 2 Havoc Pennington 2002-12-14 02:55:34 UTC
assuming NOTABUG

Note You need to log in before you can comment on or make changes to this bug.