Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182370

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

On Mon, Jun 19, 2017 at 06:00:58PM +0200, Nicolas George wrote:
> Le primidi 1er messidor, an CCXXV, Henrique de Moraes Holschuh a écrit :
> > That said, no, it is not usually considered a security vulnerability,
> > because NOT using the full path to run commands such as "su" and "sudo"
> > in the first place IS considered gross negligence.
> 
> If your account has been compromised so much that an attacker was able
> to add something in ~/bin/, then using the full path of the commands
> does not bring any extra security.

Henrique, I believe, was describing an attack that works like this:

1) Login.
2) PATH=~/bin:$PATH
3) vi ~/bin/su  (insert malicious code); chmod 755 ~/bin/su
4) Call the system administrator, and get him/her to come to your desk.
5) Get the sysadmin to run "su -c something" for you at your desk.
   This runs your password-capturing program, which records the root
   password somewhere you can retrieve it after the sysadmin leaves.

This is not an attack vector I had previously considered, so thanks
to Henrique for pointing it out.  Nevertheless, I don't think this
justifies any requests to change the default PATH in /etc/skel/.profile.
The attack can be carried out as described above regardless of what
Debian does in /etc/skel/.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web