oss-security - Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <566F3135.4050009@halfdog.net>
Date: Mon, 14 Dec 2015 21:14:29 +0000
From: halfdog <me@...fdog.net>
To: oss-security@...ts.openwall.com
Subject: Re: User man Local Root Exploit/Linux Kernel setgid
 Directory Privilege Escalation/PAM Owner Check Weakness

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dag-Erling Smørgrav wrote:
> halfdog <me@...fdog.net> writes:
>> 
http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/
>> 
>> http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/
>
>> 
> And the PAM issue?

That's the most questionable. Should it be expected from the pam
libraries to refuse authentication, when the owner/group of
/etc/shadow is completely off? Of course, attacker with possibility to
modify ownership of a single file would also find numerous other
targets to work on, but should it be so easy?

But even when deciding to change behavior, e.g. forcing libpam checks
on shadow to be root/[somegroup] and 0640 mode, could that break other
existing systems, introduce new (availability) risks?

hd

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlZvMSwACgkQxFmThv7tq+791wCZAU+jSCjJffULGkrmriXeCAKd
Q7EAnjNmfNRHai3Qt3TqtElgfkck3TPs
=ytMn
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.