"Administrator password" readable in cleartext on Breezy

[Alexander Koch]

Hi everyone,

I am new to this news group. But I just stumbled across something at
htttp://www.dig.com.

For Ubuntu Breezy you can see the password of the default user, that was
supplied during the installation.

Bugreport:
[url]https://launchpad.net/distros/ubuntu/+bug/34606[/url]

or
Ubuntu Forums:
[url]http://www.ubuntuforums.org/showthread.php?t=143334[/url]

sorry, to bring bad news. I still love ubuntu :)

But better fix this in your systems.

Greetings,
Alex

[Wayne]

On Mon, 13 Mar 2006 00:29:28 +0100, Alexander Koch wrote:

> Hi everyone,
>
> I am new to this news group. But I just stumbled across something at
> htttp://www.dig.com.
>
> For Ubuntu Breezy you can see the password of the default user, that was
> supplied during the installation.
>
> Bugreport:
> [url]https://launchpad.net/distros/ubuntu/+bug/34606[/url]
>
> or
> Ubuntu Forums:
> [url]http://www.ubuntuforums.org/showthread.php?t=143334[/url]
>
> sorry, to bring bad news. I still love ubuntu :)
>
> But better fix this in your systems.
>
> Greetings,
> Alex

I saw this on OSNews a few minutes ago and checked through my logs.
Default user password was not displayed so this does not apply to
every install for some reason.

Wayne
--
Registered Linux user #375994
[url]http://www.geocities.jp/rondonko/[/url]

[Eric Meyers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 2006-03-12, Wayne <rondonjin@yahoo.com> wrote:

> On Mon, 13 Mar 2006 00:29:28 +0100, Alexander Koch wrote:
>

>> Hi everyone,
>>
>> I am new to this news group. But I just stumbled across something at
>> htttp://www.dig.com.
>>
>> For Ubuntu Breezy you can see the password of the default user, that was
>> supplied during the installation.
>>
>> Bugreport:
>> [url]https://launchpad.net/distros/ubuntu/+bug/34606[/url]
>>
>> or
>> Ubuntu Forums:
>> [url]http://www.ubuntuforums.org/showthread.php?t=143334[/url]
>>
>> sorry, to bring bad news. I still love ubuntu :)
>>
>> But better fix this in your systems.
>>
>> Greetings,
>> Alex

>
> I saw this on OSNews a few minutes ago and checked through my logs.
> Default user password was not displayed so this does not apply to
> every install for some reason.
>
> Wayne

Wow. Thanks for the info. My password was in clear text! Yikes.

Eric

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFEFLXHcLztWWU+V+oRAjyKAJ4vNhPLYknlpYu4APMcn5 Fgmg0RowCfYN9b
CzqD4UQMh4FAIC0iEWmrOrk=
=ZkBd
-----END PGP SIGNATURE-----

[Chuck]

On Mon, 13 Mar 2006 00:29:28 +0100, Alexander Koch wrote:

A patch has already been submitted so be sure you update your systems.

sudo apt-get update
sudo apt-get upgrade

--
Chuck

[Juergen Starek]

Alexander Koch schrieb:

> For Ubuntu Breezy you can see the password of the default user, that was
> supplied during the installation.
>
> Bugreport:
> [url]https://launchpad.net/distros/ubuntu/+bug/34606[/url]

Thanks for the information. Although I cannot confirm this here on my
installation, I posted about the problem in my university's newsgroups and
I'm waiting for the feedback of other users here.

The problem, while critical, seems to be easily resolved by editing the
occurences of the password in the logfiles. Does anyone know oif it is
safe to simply delete the log file(s)? I suspect this might interfere with
the update process from Breezy to Dapper...

Jürgen

[William Tasso]

Juergen Starek <quiterigorouslyfilteredusenetaccount@gmx.de> wrote:

> Alexander Koch schrieb:
>

>> For Ubuntu Breezy you can see the password of the default user, that was
>> supplied during the installation.
>>
>> Bugreport:
>> [url]https://launchpad.net/distros/ubuntu/+bug/34606[/url]

>
> Thanks for the information. Although I cannot confirm this here on my
> installation, I posted about the problem in my university's newsgroups
> and
> I'm waiting for the feedback of other users here.
>
> The problem, while critical, seems to be easily resolved by editing the
> occurences of the password in the logfiles. Does anyone know oif it is
> safe to simply delete the log file(s)? I suspect this might interfere
> with
> the update process from Breezy to Dapper...

Worry not - deleting the file is fine.

However, if you suspect/know that any user has ever connected/logged-in to
the machine then you may be best advised to alter the password from the
install value as well. uihm yeah and change the root pw too if that's
enabled.

--
William Tasso