[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0903171600490.17171@faron.mitre.org>
Date: Tue, 17 Mar 2009 16:02:44 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: lxc-sshd security issues?
On Thu, 5 Mar 2009, Michael K. Johnson wrote:
> I finally got the right contact info upstream, and we're talking
> about this, so expect it to not be a problem in future releases.
> For the record, it's dummy auth data, but still could be seen as a
> backdoor, and will probably be changed to user-configured value.
By "dummy auth data," do you mean that it's replaced with real/unique
passwords/keys before the system becomes operational? Or do these
pre-packaged values work unless the admin RTFM? (If the latter, then it
needs a CVE; if the former, then there doesn't seem to be a vuln because
there's no impact on authentication).
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
