Obviously we can do an SRU/security update after the fact, but this does, as Marc pointed out, leave a root escalation path for malware or applications with a security hole. Perhaps worse is that it allows the malware call home with the password so that it can be used later to potentially login to the machine remotely, and then have full shell (and root if admin) without having to go through all the hoops of doing it within the malware itself.
Since this feature is not widely used, new in Lucid and seemingly not well documented in Ubuntu, wouldn't it be better to disable the feature (ie, use Martin's patch) and then restore the functionality using the upstream patch in an SRU later? This would plug the escalation issue as well as avoid a publicly announced USN. -- the login password is stored in the user's keyring https://bugs.launchpad.net/bugs/566046 You received this bug notification because you are a member of Ubuntu Bugs, which is a direct subscriber. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
