Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

ISOs between 0.9.1 and the recent dated betas forget to chmod 400
/etc/shadow in case the ISO copied over a badly perm'd shadow file.

Both the ISO script and the spell have been fixed to force strict perms.

The following files are attached for spell utils/shadow:
BUILD
DEPENDS
DETAILS
HISTORY
POST_INSTALL
TRIGGERS
adduser
deluser
pam.d/
pam.d/su
pam.d/chfn
pam.d/chsh
pam.d/login
pam.d/passwd
pam.d/shadow
pam.d/useradd
su.patch

2004-05-24 Seth Woolley <seth AT tautology.org>
        * DETAILS: updated UPDATED for SECURITY FIX
        * POST_INSTALL: force chmod 400 in /etc/shadow

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: securityupdate.16367.tar.bz2
Description: Binary data

Attachment: pgpPJfM9AIfPh.pgp
Description: PGP signature