Notified:  June 21, 2002 Updated: June 25, 2002

Status

Not Affected

Vendor Statement

Mandrake Security (aka msec) is a tool for helping administrators easily customize their computing environment according to their security needs. msec comes with several different levels of security, ranging from insecure to paranoid. While some may disagree with the default chosen during installation, expert users are prompted to choose which level of security they wish for the system during installation. As well, any user with appropriate access can change the operating secure level of msec at any time, as well as fine-tuning that level to further suit their needs. Indicating that msec in itself is insecure because of how it operates is incorrect. Reading the documentation available will help to understand how msec operates and how to customize it.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.