[ GLSA 200710-25 ] MLDonkey: Privilege escalation

[GLSA]

Gentoo Linux Security Advisory

Title: MLDonkey: Privilege escalation (GLSA 200710-25)
Severity: high
Exploitable: remote
Date: October 24, 2007
Updated: November 07, 2007
Bug(s): #189412
ID: 200710-25

Synopsis

The Gentoo MLDonkey ebuild adds a user to the system with a valid login shell and no password.

Background

MLDonkey is a peer-to-peer filesharing client that connects to several different peer-to-peer networks, including Overnet and BitTorrent.

Affected Packages

Package: net-p2p/mldonkey
Vulnerable: < 2.9.0-r3
Unaffected: >= 2.9.0-r3
Architectures: All supported architectures


Description

The Gentoo MLDonkey ebuild adds a user to the system named "p2p" so that the MLDonkey service can run under a user with low privileges. With older Portage versions this user is created with a valid login shell and no password.

Impact

A remote attacker could log into a vulnerable system as the p2p user. This would require an installed login service that permitted empty passwords, such as SSH configured with the "PermitEmptyPasswords yes" option, a local login console, or a telnet server.

Workaround

See Resolution.

Resolution

Change the p2p user's shell to disallow login. For example, as root run the following command: