Public SourceMage Discussion List

[Karsten Behrmann <BearPerson AT gmx.net>]

Hi all!
I've spotted a flaw on the recent 0.9.5-rc ISO:
/etc/shadow is installed with the wrong permissions, it is world-readable.

This is a security bug, it means that local users can brute-force any other
user's password (including root's).

Therefore, I've released an -rc2 ISO that has this bug fixed. The old
-rc has been relocated to a folder for security-flawed ISOs.

This fix should not affect anything else, so we should be able to release
0.9.5 on schedule if nothing else comes up.

So Far,
  Karsten

-- 
Karsten Behrmann    |  Source Mage GNU/Linux developer, ISO team
BearPerson AT gmx.net  |  http://www.sourcemage.org

Attachment: pgpT1EftR93AW.pgp
Description: PGP signature