[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110315111311.GA13957@suse.de>
Date: Tue, 15 Mar 2011 12:13:11 +0100
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Cc: kov@...ian.org
Subject: gksu-polkit
Hi,
I already sent this to vendor-sec a while ago (cant remember
whether this already received a CVE and which) as well as to
the maintainer (Cc) which did not yield a response.
So I send it here again. Merging X cookies is probably not
a good idea by itself for sudo like programs but this problem
adds more.
Sebastian
-------------------------->8----------------------
While reviewing possible replacements for libgnomesu, I found that
the gksu-polkit contains a weird vulnerability that allows
to escalate privileges.
Basically the gksu-server is a DBUS activation that runs as root.
Users invoke the Spawn method via DBUS and gksu-server components
check via polkit whether the user is allowed to run the program.
Despite the "nice" architecture involving dozens of glib, dbus etc.
libs for such a simple purpose as well as running Vala generated source code
as root, it has an inlining problem.
gksu-server tries to merge the X11 cookie credentials via xauth commands.
It creates a script file (as root) which it passes to xauth like so:
gboolean gksu_controller_prepare_xauth()
{
[...]
xauth_display = g_hash_table_lookup(environment, "DISPLAY");
[...]
xauth_cmd = g_strdup_printf("add %s . %s\n", xauth_display, xauth_token);
fwrite(xauth_cmd, sizeof(gchar), strlen(xauth_cmd), file);
[...]
command = g_strdup_printf("%s -q -f %s source %s", xauth_bin, xauth_file, tmpfilename);
g_spawn_command_line_sync(command, NULL, NULL, &return_code, &error);
[...]
}
while the creation of the tmp file looks safe, the DISPLAY variable might
be passed by the user to the Spawn DBUS method. It may contain newlines,
spaces etc. since the default common.variables file allows to pass
unrestricted data via DISPLAY to it.
Therefore the source file for xauth may contain arbitrary commands,
e.g. extracting user owned X11 cookies to root's .Xauthority
or to /etc/passwd. He may then overtake a administrator X11 session
since his cookies have been placed to /root/ or "carefully chooses"
a token that matches a /etc/passwd entry.
Same maybe applies to xauth_token which might contain newlines etc.
The default config must contain regex that forbid such characters or
the token handling inside gksu-server has to be done differently.
--
~
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
~ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
