[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <32e68d18-01e4-ff5f-c386-9aae4569205b@gentoo.org>
Date: Fri, 13 Jan 2017 20:55:42 +0100
From: Thomas Deutschmann <whissi@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: Nginx (Debian-based + Gentoo distros) - Root
Privilege Escalation [CVE-2016-1247 UPDATE]
On 2017-01-13 19:26, Carlos Alberto Lopez Perez wrote:
> /me happy to know that logrotate has a sane behaviour and avoids
> trying to rotate symlinks.
But don't forget hardlinks ...
> So the issue is than when in var/log/nginx/ there are standard logs
> (non symlinked) that need to be rotated (appart from the malicious
> symlinked one), then logrotate will rotate those ones, finally
> running the post-rotate script that send SIGURSR1 to the nginx pid.
Just to be sure that we don't misunderstand each other:
Dawid's advisory only uses logrotate because this is present on most
servers and guarantees privilege escalation on a given time which makes
it easier to understand.
But escalation happens via nginx master process which is running as root
and changes owner of existing files.
Without logrotate you can still exploit any system when you can write to
the directory used by nginx for storing log files (and don't forget your
vhosts!). The attacker only have to wait an undefined amount of time,
i.e. for anyone causing nginx to chown files again. On systems running
nginx it is not the question *if* it will happen but only *when*.
--
Regards,
Thomas Deutschmann
Download attachment "signature.asc" of type "application/pgp-signature" (952 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
