Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 23 Feb 2011 10:01:07 +0100
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: gdm PostLogin script executes scripts as user gdm

Am Dienstag 22 Februar 2011 21:54:11 schrieb Josh Bressers:
> 
> ----- Original Message -----
> > Hello oss-security,
> > 
> > should we consider this as a vulnerability?
> > https://bugzilla.gnome.org/show_bug.cgi?id=602403
> > 
> 
> I'm not sure this is a security flaw. It's not running user controlled
> scripts (at least not by default). In order for it to run a user controlled
> script, the admin would have to modify the Default script. Is this normal?
> 
> I'm not all that familiar with expected use of gdm, perhaps someone who
> knows more can chime in?

I am not familiar with this functionality too. The bug reporter states that
the handling was differently in the past. This different behaviour may
lead to security problems for the deployed systems... hmmm.


Thomas

-- 
 Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
--
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.