[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180614181259.s2qbbdaeudg4h5pz@jwilk.net>
Date: Thu, 14 Jun 2018 20:12:59 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: Are `su user' and/or `sudo -u user sh' considered
dangerous?
* Georgi Guninski <guninski@...inski.com>, 2018-06-13, 12:54:
>>Is there POC for relatively new distros?
>debian 8 and 9 are vulnerable to su - hostile:
>https://j.ludost.net/blog/archives/2018/06/13/ancient_su_-_hostile_vulnerability_in_debian_8_and_9/index.html
(Please fix unescaped "<" and "&" characters on that page.)
For Debian this bug is tracked here:
https://bugs.debian.org/628843
>what about the second potential vulnerability: reading root's tty after
>the session is closed with something like tee(1) ?
The list of nasty things you can do when you get your hands on the tty
fd is probably very long...
>several sources suggest disabling TIOCSTI or using setsid(), are they
>enough?
setsid() defeats TIOCSTI (while breaking other things like job
control...); it doesn't stop other attacks that don't require
controlling terminal.
Until su is fixed to allocate new pty, I recommend running it under a
standalone terminal emulator, such as screen or tmux. This has also an
advantage that it's possible to tell that the invoked program actually
terminated, instead of just pretending to terminate and faking root
shell UI.
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
