making Debian secure by default

From	Lee <ler762@gmail.com>
Newsgroups	linux.debian.user
Subject	making Debian secure by default
Date	2024-03-27 22:40 +0100
Message-ID	<ImJa1-27aa-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

I just saw this advisory
  Escape sequence injection in util-linux wall (CVE-2024-28085)
    https://seclists.org/fulldisclosure/2024/Mar/35
where they're talking about grabbing other users sudo password.

Apparently the root of the security issue is that wall is a setguid program?

Even more fun is the instructions
  To make sure the PoC will work, make sure your victim user can
  actually receive messages. First check that mesg is set to y
  (`mesg y`). If a user does not have mesg turned on, they are not
  exploitable.

WTF??  I've never heard of a mesg, but
  $ which mesg
  /usr/bin/mesg

So.  There is a program called 'mesg',  hrmmm..
  man mesg
    ...
  Traditionally, write access is allowed by default.  However,  as  users
  become  more  conscious  of various security risks, there is a trend to
  remove write access by default, at least for the primary  login  shell.
  To  make  sure  your ttys are set the way you want them to be set, mesg
  should be executed in your login scripts.

oof.  Are there instructions somewhere on how to make Debian secure by default?

Thanks,
Lee

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

making Debian secure by default Lee <ler762@gmail.com> - 2024-03-27 22:40 +0100
  Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 00:10 +0100
    Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 05:30 +0100
      Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 14:40 +0100
        Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 16:30 +0100
          Re: making Debian secure by default Hans <hans.ullrich@loop.de> - 2024-03-28 16:50 +0100
            Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 19:20 +0100
              Re: making Debian secure by default Ralph Aichinger <ra@h5.or.at> - 2024-03-29 08:50 +0100
              Re: making Debian secure by default Stefan Monnier <monnier@iro.umontreal.ca> - 2024-03-29 20:10 +0100
              Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-29 20:40 +0100
          Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 17:00 +0100
            Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 21:20 +0100
          Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-28 18:50 +0100
            Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 20:40 +0100
            Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-29 18:00 +0100
              Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-03-29 18:30 +0100
                Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 18:50 +0100
                Re: making Debian secure by default Nicholas Geovanis <nickgeovanis@gmail.com> - 2024-04-01 02:30 +0200
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-01 03:50 +0200
                Re: making Debian secure by default Roberto C. Sánchez <roberto@debian.org> - 2024-04-01 05:00 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-01 10:40 +0200
                Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default Charles Curley <charlescurley@charlescurley.com> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default John Hasler <john@sugarbit.com> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default John Hasler <john@sugarbit.com> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-04-06 09:52 +0200
              Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 18:50 +0100
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-29 21:00 +0100
                Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-30 17:10 +0100
          Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 19:10 +0100
            Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-28 23:20 +0100
    Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 17:30 +0100
      Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 18:10 +0100
      Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 18:10 +0100
        Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 18:10 +0100
  Re: making Debian secure by default jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-28 00:40 +0100
    Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 00:50 +0100
      Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 05:50 +0100
  Re: making Debian secure by default <tomas@tuxteam.de> - 2024-03-28 06:20 +0100
    Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-28 06:30 +0100
      Re: making Debian secure by default <tomas@tuxteam.de> - 2024-03-28 08:20 +0100
      Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 12:20 +0100
        Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-28 12:40 +0100
          Re: making Debian secure by default David Wright <deblis@lionunicorn.co.uk> - 2024-03-28 21:40 +0100
            Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-29 10:40 +0100
              Re: making Debian secure by default David Wright <deblis@lionunicorn.co.uk> - 2024-03-30 04:00 +0100
    Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-28 15:50 +0100
    Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 17:30 +0100
      Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 18:10 +0100
        Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 21:50 +0100
      Re: making Debian secure by default tomas@tuxteam.de - 2024-03-28 18:30 +0100
        Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 20:30 +0100
          Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 20:30 +0100
            Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 21:50 +0100
          Re: making Debian secure by default tomas@tuxteam.de - 2024-03-28 21:20 +0100
            Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 17:10 +0100
              Re: making Debian secure by default debian-user@howorth.org.uk - 2024-03-29 21:50 +0100
    Re: making Debian secure by default debian-user@howorth.org.uk - 2024-03-28 22:50 +0100
  Re: making Debian secure by default Marc SCHAEFER <schaefer@alphanet.ch> - 2024-03-28 12:10 +0100
    Re: making Debian secure by default Franco Martelli <martellif67@gmail.com> - 2024-03-28 17:30 +0100
    Re: making Debian secure by default Michel Verdier <mv524@free.fr> - 2024-03-28 17:30 +0100
      Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 17:40 +0100
  Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 21:50 +0100
  Re: making Debian secure by default Richmond <dnomhcir@gmx.com> - 2024-03-28 21:50 +0100
  Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-29 16:40 +0100
  Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-31 21:10 +0200
    Re: making Debian secure by default Roberto C. Sánchez <roberto@debian.org> - 2024-03-31 21:30 +0200
      Re: making Debian secure by default gene heskett <gheskett@shentel.net> - 2024-03-31 22:30 +0200
        Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-31 23:20 +0200
          Re: making Debian secure by default gene heskett <gheskett@shentel.net> - 2024-04-01 01:00 +0200

csiph-web