authentication in livesession accepts any value as password

[Elfy]

Boot livesession, open catfish and try to update the database.

Authentication dialogue accepts any value - rather than not want one. Livesession's being passwordless generally.

Tried with admin, test, abracadabra and amIgoinginsane - all were accepted and database was unlocked and updated.

ProblemType: Bug
DistroRelease: Ubuntu 15.04
Package: catfish 1.2.2-1
ProcVersionSignature: Ubuntu 3.16.0-24.32-generic 3.16.4
Uname: Linux 3.16.0-24-generic x86_64
ApportVersion: 2.14.7-0ubuntu10
Architecture: amd64
CasperVersion: 1.346
CurrentDesktop: XFCE
Date: Mon Nov 24 13:28:09 2014
LiveMediaBuild: Xubuntu 15.04 "Vivid Vervet" - Alpha amd64 (20141124)
PackageArchitecture: all
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: catfish
UpgradeStatus: No upgrade log present (probably fresh install)

[Ubuntu QA Website (ubuntuqa)]

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/1395720

[Ubuntu QA Website (ubuntuqa)]

This bug has been reported on the Ubuntu Package testing tracker.

A list of all reports related to this bug can be found here:
http://packages.qa.ubuntu.com/qatracker/reports/bugs/1395720

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Lyn Perrine (walterorlin)]

I was able to reproduce this in Lubuntu after installing catfish. I tried WeLoveAlladinSane as a password and it authentaticated.

[Elfy (elfy)]

given that if someone is able to only reproduce this in a livesession - and thus has physical access - not really a security issue - or if it is such - something that we're not able to deal with using software

[Thaddaeus Tintenfisch (thad-fisch-deactivatedaccount)]

Accepting any password in a password-less environment (live session) is not a security issue.

[Sean Davis (bluesabre)]

Fixed at revision https://bazaar.launchpad.net/~catfish-search/catfish-search/trunk/revision/380

[Launchpad Janitor (janitor)]

This bug was fixed in the package catfish - 1.3.1-0ubuntu1

---------------
catfish (1.3.1-0ubuntu1) wily; urgency=medium

  * New upstream bugfix release
    - Fix: authentication in livesession accepts any
      value as password (LP: #1395720)
    - Fix: Catfish will lock up if 'locate' is not
      installed (LP: #1482919)
    - Fix: Catfish does not find files whose size
      exceeds 2GB (LP: #1442559)

 -- Sean Davis <email address hidden> Tue, 08 Sep 2015 20:54:13 -0400