USN-670-1: VMBuilder vulnerability

Ubuntu Security Notice USN-670-1

13th November, 2008

vm-builder vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 8.10
  • Ubuntu 8.04 LTS
  • Ubuntu 7.10
  • Ubuntu 6.06 LTS

Software description

  • shadow
  • vm-builder


Mathias Gug discovered that vm-builder improperly set the root
password when creating virtual machines. An attacker could exploit
this to gain root privileges to the virtual machine by using a
predictable password.

This vulnerability only affects virtual machines created with
vm-builder under Ubuntu 8.10, and does not affect native Ubuntu
installations. An update was made to the shadow package to detect
vulnerable systems and disable password authentication for the
root account. Vulnerable virtual machines which an attacker has
access to should be considered compromised, and appropriate actions
taken to secure the machine.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 8.10:
passwd 1:4.1.1-1ubuntu1.1
python-vm-builder 0.9-0ubuntu3.1
Ubuntu 8.04 LTS:
passwd 1:
Ubuntu 7.10:
passwd 1:
Ubuntu 6.06 LTS:
passwd 1:4.0.13-7ubuntu3.3

To update your system, please follow these instructions:

In general, a standard system upgrade is sufficient to effect the
necessary changes.