Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182374

Re: where to submit low security vulnerability in .profile?

From Nicolas George <george@nsup.org>
Newsgroups linux.debian.user
Subject Re: where to submit low security vulnerability in .profile?
Date 2017-06-19 19:20 +0200
Message-ID <tU8vg-5zu-9@gated-at.bofh.it> (permalink)
References <tTAMW-Uh-1@gated-at.bofh.it> <tU48i-2E1-19@gated-at.bofh.it> <tU7fP-4Bo-3@gated-at.bofh.it> <tU7pw-4Ul-31@gated-at.bofh.it> <tU7pw-4Ul-29@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Le primidi 1er messidor, an CCXXV, Greg Wooledge a écrit :
> Henrique, I believe, was describing an attack that works like this:
> 
> 2) PATH=~/bin:$PATH
> 3) vi ~/bin/su  (insert malicious code); chmod 755 ~/bin/su
> 4) Call the system administrator, and get him/her to come to your desk.

I do not think so, as the default value set in the distribution has no
relevance for that kind of attack.

Regards,

-- 
  Nicolas George

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web