package: debian-installer
severity: important
tags: security
there is now an option in the expert mode of the debian-installer that
allows the user to install their system without a root account
(replacing it with sudo priviledges for the default user). this exposes
a loophole that enables local attackers to easily obtain root access.
details:
since there is no root password set up during installation, a local
attacker can simply boot into the root account (without being prompted
for a password) via single user mode ("single" kernel option). then,
he/she can do all kinds of malicious things, but the easiest would be
to simply change the root password...thus owning the machine. and
since the user never logs in with the root password him/herself,
he/she would never realize that an attacker had gotten in (unless
he/she diligently reviews logs). [1] discusses the details of the
method for password recovery, but the same can be used for malicious
purposes, of course.
potential solutions:
1. always create a root password (e.g. set up a random root password,
rather than no password, during the no root debian-installer setup
page). note that this may currently be done since "su" itself asks for
a password.
2. drop the user to a full login prompt when booting into single user
mode; thus requiring a valid user account and sudo to perform
administrative actions. note that it may be possible to circumvent
this via the "init" kernel option, for example "init=/bin/bash".
3. disable the no-root setup page in debian-installer.
the third option may be the easiest to implement immediately --
especially since it's an experimental option in the expert mode of
the installer. the second option is probably the most robust, but
might be easily circumvented, and would require changes in single user
mode such as automatically mounting /home, which may make single user
mode harder to use (one use case for this mode is to recover or
scan /home, and if it's mounted, that's more difficult).
justification for why a fix for this problem is necessary:
there are levels of vulnerability/security. at the lowest level are
pure software vulnerabilities (such as this issue), which require
absolutely no effort for a local attacker. however, for a
hardware-assisted exploit, it requires surrepticious entry, more time,
and more preparedness (and it looks suspicious, and can be somewhat
prevented by limiting access to areas via locks, valid users only,
etc). the user can also increase their security by disabling boot from
media in the bios, which would force the attacker to spend more time to
crack open the machine, which is even more suspicious.
at each level, it takes more and more time for the attacker to exploit
the vulnerability, thus increasing the chance of detecting them. less
than a minute for the software exploit, 10s of minutes for hardware
assisted and longer for resetting the bios.
severity:
note that the severity of this problem is fairly low right now since
no-root is a non-default option in the "expert" installer. hence, few
debian systems are likely exposed; but regardless, this problem should
be fixed asap. note that no-root has been the default installer
behavior for ubuntu (since at least dapper i think), so it is a much
more severe issue for them.
[1] http://linuxwave.blogspot.com/2008/09/ubuntu-forgotten-password.html
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
