strange ip addres listed when you run "last -i" command
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| gdm (Ubuntu) |
Fix Released
|
Medium
|
Sebastien Bacher | ||
Bug Description
- at first a few of us in #ubuntu noticed that if you run "last -i" you get a
list of logins with some really strange ip addresses
- two commonly listed addresses that appear in the list are: 194.135.4.8 and
242.135.4.8
- googling and checking the bug tracker revealed nothing of significance in
terms of similar situations or circumstances
- installing xnest and simulating several logins reveals that each time a user
logs in, either one of the above ip addresses show up, amongst the normal local
user ip of 0.0.0.0
- a few users reported other strange ip's listed when you do "last -i" but those
seem to be generated at login as well.
- to reproduce:
1. login as user
2. install xnest
3. login as many times as you like via xnest, after each login do "last -i" on
command line and see the strange ip address corresponding with each login entry
4. alternatively, you can log out and login in using the main login menu (not
via xnest), and after each time to "last -i" to find strange ip addresses
corresponding to the time stamp for the login
- the fix: on my debian systems all entries correspond to the exact ip address
from which we are logging into that machine, so ideally since this test was done
as a local use on a local machine all ip entries should read 0.0.0.0
| Matt Zimmerman (mdz) wrote | #1 |
| Sebastien Bacher (seb128) wrote | #2 |
| Jorge Castro (jorge) wrote | #3 |
| Sebastien Bacher (seb128) wrote | #4 |
| Kenneth Loafman (kenneth-loafman) wrote | #5 |
It seems like perhaps gdm is not initializing the memory used for that field, or
some such. I don't think there's a security issue here.