oss-security - What is the "Grinch" polkit/wheel group issue?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141217170009.GD23294@suse.de>
Date: Wed, 17 Dec 2014 18:00:09 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: What is the "Grinch" polkit/wheel group issue?

Hi,

This probably needs a CVE too, or does it have one?

https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/
http://www.pcworld.com/article/2860032/this-linux-grinch-could-put-a-hole-in-your-security-stocking.html

Although it seems that the user is in the "wheel" group for this to be exploitable
and is hard to specify what actions should be safed by another query or which should not.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.