Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182280

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

On 06/18/2017 05:05 AM, Nicolas George wrote:
> Le decadi 30 prairial, an CCXXV, David Bunch a écrit :
>> This could be a potential security vulnerability because if the user account
>> of a uesr with 'su' power, an attacker could place a malicious 'su', 'ls',
>> and 'which' in their ~/bin directory which could give an attacker the root
>> password when the user runs the 'su' command.
> 
> If the attacker is able to write in ~/bin, then they are also able to
> write in ~/.profile and add anything they want there. Therefore, the
> change you suggest does absolutely nothing for security.
> 
>> A safer configuration would be PATH=$PATH:'$HOME/bin'.
> 
> If a user installs a program in their home that is already available on
> the system, it probably means they want to use their version rather than
> the system's. The same goes for programs installed by the admin versus
> programs installed by the distribution. Hence, the correct order is
> really ~/bin, /usr/local/bin then /usr/bin and not the other way around.
> 
> Regards,
> 

I can see David's concern though if one puts their own version of 
something and it's compromised.

But now that you mention it, one should now better than to do that. :)

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web