Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182266

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Le decadi 30 prairial, an CCXXV, David Bunch a écrit :
> This could be a potential security vulnerability because if the user account
> of a uesr with 'su' power, an attacker could place a malicious 'su', 'ls', 
> and 'which' in their ~/bin directory which could give an attacker the root
> password when the user runs the 'su' command.  

If the attacker is able to write in ~/bin, then they are also able to
write in ~/.profile and add anything they want there. Therefore, the
change you suggest does absolutely nothing for security.

> A safer configuration would be PATH=$PATH:'$HOME/bin'.

If a user installs a program in their home that is already available on
the system, it probably means they want to use their version rather than
the system's. The same goes for programs installed by the admin versus
programs installed by the distribution. Hence, the correct order is
really ~/bin, /usr/local/bin then /usr/bin and not the other way around.

Regards,

-- 
  Nicolas George

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web