|Main Archive Page > Month Archives > full-disclosure-uk archives|
rPath Security Advisory: 2007-0096-1
Products: rPath Linux 1
Exposure Level Classification:
Indirect Non-deterministic Weakness
Previous versions of the shadow package have a weakness in the useradd program; it may in some cases create new mail spool files with a mode that may be vulnerable to reading and/or writing by attackers with local system access. Note that, despite the clear bug in the source code, we have seen no instances in practice of mail spool files being created with insecure permissions. This update will not fix permissions on existing system mailbox files, since it is not possible to determine if any particular set of permissions was chosen intentionally. Mail spool files are normally mode 660.
Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License. A copy is available at http://www.rpath.com/permanent/mit-license.html