lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 31 Aug 2004 20:48:50 +0200 (CEST) From: "Rainer Duffner" <rainer@...ra-secure.de> To: "Rene" <l0om@...luded.org> Cc: bugtraq@...urityfocus.com Subject: Re: Linux OpenExchange - cleartext rootpw in swap On Di, 31.08.2004, 10:11, Rene sagte: > > > date: 31.08.2004 > author: l0om - l0om [at] excluded dot org - www.excluded.org > discovered in: SuSE Linux Openexchange Server 4 > problem: cleartext rootpw in swap caused by fergotten "mlock" or wiping > out memory > > > hi, > > i have noticed my root password flying around on my swap in cleartext. > an attacker who has successfully rooted a box can get the cleartext > password from the swap device. > > i dont know if this is caused by some SuSE mistake at the web login- maybe > its a fault in openldap. > i dont know exactly where this is caused. > Well, if the server is "rooted", as you like to put it, there's little point in gaining the root-password anyway, isn't it ? You can do pretty much everything, except login as the administrator-user via the web-interface. Being able to scratch the root-pw out of swap is just a bonus, if you ask me. It would be bad, if a non-priviledged user had access to the swap-partition. On the two SLOXs I have access to, the swap-partition is only group-readable by the "disk" group. Or is there some other way of reading the swap-partition ? If not, this is not a big concern to me (and we run and support some of these for various customers). If, OTOH, you had talked about the empty password for the SLOX' postgres-database.... that would be something completely different (TM). cheers, Rainer
Powered by blists - more mailing lists