Großes Sicherheitsleck in Ubuntu Breezy

Wie kann so etwas nur passieren?

The root password from the first user registred by Breezy can be found by any user by reading the file /var/log/installer/cdebconf/questions.dat

a quick

grep -r rootpassword /var

shows that the rootpassword is forgotten in cleartext by the installer on several occations

/var/log/installer/cdebconf/questions.dat:Value: mypasswd
/var/log/installer/cdebconf/questions.dat:Value: mypasswd
/var/log/debian-installer/cdebconf/questions.dat:Value: mypasswd /var/log/debian-installer/cdebconf/questions.dat:Value: mypasswd

Habe es bei meiner Installation überprüft — es stimmt. 🙁

Quelle: launchpad.net/distros/ubuntu/+bug/34606