[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1314349111.23138.13.camel@scapa>
Date: Fri, 26 Aug 2011 10:58:26 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: Sebastian Krahmer <krahmer@...e.de>
Cc: 639151@...s.debian.org, Moritz Muehlenhoff <jmm@...ian.org>,
robert.ancell@...onical.com, oss-security@...ts.openwall.com
Subject: Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local
privilege escalation
On ven., 2011-08-26 at 10:43 +0200, Sebastian Krahmer wrote:
> Hi,
>
> You probably dont take into account the chown() that happens in lightdm.
> Just unlink the created ~/.dmrc or ~/.Xauthority files after creation and make a symlink
> to /etc/passwd to chown it to yourself.
The chown will be applied to the symlink, not the target. I've tried to
make .Xauthority a symlink to a root-owned file and the destination was
indeed destroyed, but it's still root-owned.
> However I didnt dig deep enough into it to write an exploit as I dont have
> a working lightdm setup. The correct behavior is to temporarily drop euid/fsuid
> to that of the user if doing anything with his files.
Yeah, I'm currently cooking patches doing that, though they'll need
review before apply.
>
> The PAM issue that I was curious about was that a pam_start() etc is done
> for the greeter-user (which I expect to be some "lightdm" user)?
Yes
>
> I would expect all pam_ calls are only done for the user who is actually
> about to login. The question that came up to me was whether pam_environment
> from the user would have impact on uid-0 called programs/scripts since
> you transfer the PAM env to the process env.
Yeah, that looks fishy, though I have no idea how it's exactly cooked
that way, we'll have to wait for an answer from Robert.
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
