[SA19589] Debian mnogosearch Insecure Password Storage Security Issue

TITLE:
Debian mnogosearch Insecure Password Storage Security Issue

SECUNIA ADVISORY ID:
SA19589

VERIFY ADVISORY:
http://secunia.com/advisories/19589/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information

WHERE:
Local system

OPERATING SYSTEM:
Debian GNU/Linux 3.1
http://secunia.com/product/5307/
Debian GNU/Linux unstable alias sid
http://secunia.com/product/530/

DESCRIPTION:
Andrew Pam has discovered a security issue in Debian mnogosearch,
which can be exploited by malicious, local users to gain knowledge of
sensitive information.

The database administrator password is stored in the world-readable
file "/var/cache/debconf/config.dat" when automatic database
configuration is chosen during the configuration process.

The security issue has been confirmed in versions 3.2.31-1 and
3.2.33-1. Other versions may also be affected.

SOLUTION:
Do not choose automatic database setup during the configuration
process and check "/var/cache/debconf/config.dat" for sensitive data.

PROVIDED AND/OR DISCOVERED BY:
Andrew Pam

ORIGINAL ADVISORY:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361775

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.