Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182288

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

On Sun 18 Jun 2017 at 07:55:32 (-0400), RavenLX wrote:
> On 06/18/2017 12:56 AM, David Bunch wrote:
> >Hi,
> >
> >I'm not sure where or how or even if i should submit a bug small security
> >vulnerability in the default .profile that is created in each users home
> >directory.
> >
> >.profile searches for a ~/bin directory and if it finds it prepends it to
> >PATH like so: PATH='$HOME/bin':$PATH
> >
> >This could be a potential security vulnerability because if the user account
> >of a uesr with 'su' power, an attacker could place a malicious 'su', 'ls',
> >and 'which' in their ~/bin directory which could give an attacker the root
> >password when the user runs the 'su' command.
> >
> >A safer configuration would be PATH=$PATH:'$HOME/bin'.
> >This way if malicious copies of systems programs were placed in the user's
> >~/bin directory the uncompromised system copies would be still be run.

I agree with Nicolas, even though I use the latter order; not for
security's sake, but just because I don't make a habit of overriding
system commands. My only exception is "cdeject is aliased to `eject'"
for the simple reason that in a recent Debian version, cdeject would
provoke an I/O error and leave the drive's own button inoperable
whereas eject worked fine.

> That's interesting. I didn't know there was a difference but now
> that I look at it, I think you're right. In Jessie, I had to set
> this manually in ~/.bashrc because it didn't work out of the box for
> some reason.

Check if you use ~/.bash_profile or ~/.bash_login, either of which
will prevent ~/.profile from being read.

~/.bashrc ought be written in a way that allows for repeated calls.
A simple PATH='$HOME/bin':$PATH will keep lengthening the PATH.

The INVOCATION paragraphs in man bash make heavy but essential
reading. AFAIK its tautological "reads and executes commands from
~/.bashrc and ~/.bashrc" is just a typo.

Cheers,
David.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web