Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182369

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

On Mon, 19 Jun 2017, Greg Wooledge wrote:
> You appear to be claiming that putting ~/bin in PATH is somehow inherently
> unsafe.  I don't agree.  Under what conditions would this result in any
> kind of privilege escalation?

The OP was complaining that ~/bin was being *prepended* to PATH, instead
of appended.

When you prepend ~/bin to PATH, it allows one to have a shell script
such as ~/bin/sudo that will be run instead of the system's sudo.  Then,
some use of social engineering might get an admin or some other user to
type in a password to run a command using su or sudo.

That said, no, it is not usually considered a security vulnerability,
because NOT using the full path to run commands such as "su" and "sudo"
in the first place IS considered gross negligence.

So, train your fingers!  There is no "su", it *is* /bin/su.  And there
is no "sudo", it *is* /usr/bin/sudo.  Never trust aliases, PATH, or
anything of the like for this stuff.

Still, IMHO it would be much better if we *appended* ~/bin to PATH,
instead.  I just checked, and "bash" in stretch seems to do the wrong
thing...

> What does "'su' power" mean, anyway?  That the end user has been given
> the root password?  If you've given someone the root password, they
> already have whatever power they want.

This is usually coupled to some social engineering to get someone else
that has the password to think (s)he is running the system su/sudo and
type it.

-- 
  Henrique Holschuh

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web