Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182381

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

On Mon, 19 Jun 2017, The Wanderer wrote:
> On 2017-06-19 at 11:59, Henrique de Moraes Holschuh wrote:
> > On Mon, 19 Jun 2017, Greg Wooledge wrote:
> >> You appear to be claiming that putting ~/bin in PATH is somehow
> >> inherently unsafe.  I don't agree.  Under what conditions would
> >> this result in any kind of privilege escalation?
> > 
> > The OP was complaining that ~/bin was being *prepended* to PATH,
> > instead of appended.
> > 
> > When you prepend ~/bin to PATH, it allows one to have a shell script
> > such as ~/bin/sudo that will be run instead of the system's sudo.
> > Then, some use of social engineering might get an admin or some other
> > user to type in a password to run a command using su or sudo.
> > 
> > That said, no, it is not usually considered a security
> > vulnerability, because NOT using the full path to run commands such
> > as "su" and "sudo" in the first place IS considered gross
> > negligence.
> > 
> > So, train your fingers!  There is no "su", it *is* /bin/su.  And
> > there is no "sudo", it *is* /usr/bin/sudo.  Never trust aliases,
> > PATH, or anything of the like for this stuff.
> 
> Wouldn't that seem to be an argument against installing the real su,
> sudo, and so forth, _anywhere_ in $PATH? If running them in any other
> way than with the full explicit path is such bad security practice, then
> why do we install them in such a way as to facilitate doing so?

It would.  I don't know of anyone that does that, though, because it is
too painful to be worth it.

The fact is, if we remove them, we will get a lot of complains, and it
will break someone's scripts for sure (note: if these scripts set PATH
to something trusted, they're *not* unsafe).

Besides, it is valid for anything that will ask for passwords or
sensitive data.

One also has to pay attention to not ever "help the logged-in user"
under a terminal tap, rogue screen/tmux session, "script", etc...

-- 
  Henrique Holschuh

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web