search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Mandrake Security may make unexpected system modifications

Vulnerability Note VU#455323

Original Release Date: 2002-06-25 | Last Revised: 2002-06-25


The Mandrake Security utility included with Mandrake Linux may make unexpected modifications that affect system security.


Mandrake Linux includes a tool named Mandrake Security (msec) that allows system administrators to manage and audit various system parameters associated with host security. These parameters include port-based access control, shell and console timeout values, user and root login policies, password maintenance, and system activity logging. System administrators may choose one of several preset security levels, then specify exceptions to these default policies.

The CERT/CC has learned of a public report which states that the msec security level on a default installation of Mandrake Linux sets the file permissions of each user's home directory to mode 755, allowing full access to the directory owner, read-only access to group members, and read-only access to other users. In addition, the report alleges that if these settings are modified, the msec utility will restore the default settings during a periodic system audit.

Although this utility may result in unexpected behavior, it appears that this behavior accurately maintains the configured security policy and is consistent with the product documentation. Given that the documentation is readily available and the utility allows system administrators to customize the behavior of msec, the CERT/CC does not believe that this utility represents a security vulnerability.


This utility accurately and consistently performs as documented. However, system administrators who do not understand its operation may encounter unexpected behavior.


Read the msec documentation

The CERT/CC encourages system administrators who wish to alter the default behavior of msec to read the product documentation and customize their msec configuration as appropriate.

Vendor Information


MandrakeSoft Not Affected

Notified:  June 21, 2002 Updated: June 25, 2002


Not Affected

Vendor Statement

Mandrake Security (aka msec) is a tool for helping administrators easily customize their computing environment according to their security needs. msec comes with several different levels of security, ranging from insecure to paranoid. While some may disagree with the default chosen during installation, expert users are prompted to choose which level of security they wish for the system during installation. As well, any user with appropriate access can change the operating secure level of msec at any time, as well as fine-tuning that level to further suit their needs. Indicating that msec in itself is insecure because of how it operates is incorrect. Reading the documentation available will help to understand how msec operates and how to customize it.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This issue was reported to the Bugtraq mailing list by Spot on June 17, 2002.

This document was written by Jeffrey P. Lanza.

Other Information

CVE IDs: None
Severity Metric: 0.19
Date Public: 2002-06-17
Date First Published: 2002-06-25
Date Last Updated: 2002-06-25 21:58 UTC
Document Revision: 13

Sponsored by CISA.