PT-2008-6251 · Canonical · Vmbuilder+3

Nick Barcet + 1 · Published 2008-11-17 · Updated 2017-08-08 · CVE-2008-5104

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ubuntu versions 6.06 LTS, 7.10, 8.04 LTS, and 8.10

Description The issue allows attackers to bypass intended login restrictions due to the default root password being set to ! (exclamation point) when Ubuntu is installed as a virtual machine using python-vm-builder or ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10.

Recommendations For Ubuntu versions 6.06 LTS, 7.10, 8.04 LTS, and 8.10, change the default root password to a secure password to prevent unauthorized access.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-5104

Affected Products

Ubuntu

Vmbuilder

Python-Vm-Builder

Ubuntu-Vm-Builder

References · 7

• 🔥 http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff · Exploit
• http://ubuntu.com/usn/usn-670-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5104 · Security Note
• http://securityfocus.com/bid/32292 · Patch
• http://secunia.com/advisories/32697 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46881 · Note
• https://bugs.launchpad.net/ubuntu/+source/vm-builder/+bug/296841 · Note