oss-sec mailing list archives
Re: What is the "Grinch" polkit/wheel group issue?
From: Dean Pierce <pierce403 () gmail com>
Date: Wed, 17 Dec 2014 10:38:26 -0800
The key here is the line: "In order to exploit this, all we need is a single vulnerability in any package in a repo. There are tons to choose from. If we type ‘PKCon’ or simply ‘man PKCon,’ we can find a list of repos in use and then pull a list of all bins and version numbers. I won’t provide one here because you don’t want everything handed to you." Had they actually found a package they could leverage to get root, then this would absolutely be a vulnerability, but they didn't. While configuring pkcon to allow admins to install packages without typing in a password *is* something that might be unexpected for people unfamiliar with polkit, that is the exact type of use case it was built for. - DEAN On Wed, Dec 17, 2014 at 10:24 AM, Kurt Seifried <kseifried () redhat com> wrote:
On 17/12/14 10:00 AM, Marcus Meissner wrote:Hi, This probably needs a CVE too, or does it have one? https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/ http://www.pcworld.com/article/2860032/this-linux-grinch-could-put-a-hole-in-your-security-stocking.html Although it seems that the user is in the "wheel" group for this to be exploitable and is hard to specify what actions should be safed by another query or which should not. Ciao, MarcusYeah I looked into this (the article/etc was completely confusing and took some time to parse): 1) the article states they contacted red hat, we were unable to find any inbound email or bugzilla entry pertaining to this issue, as always if you have an issue you wish to report please contact secalert () redhat com 2) this is expected behaviour, admin users can install software (do I have to say this? really? yes. I was told I should say this). 3) don't run web apps as admin users (do I have to say this? really? yes. I was told I should say this). 4) if you feel the need to run a web app as an admin user restrict what they can do via SELinux, and don't let them install software (do I have to say this? really? yes. I was told I should say this). So TL;DR: it's not a security vulnerability, and it will NOT be getting a CVE. I can only assume this article/vuln is perhaps referring to something like Cpanel and other control panels that people sometimes install insecurely/improperly and then never update. Or something. Who knows. -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Current thread:
- What is the "Grinch" polkit/wheel group issue? Marcus Meissner (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Elad Alfassa (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Todd C. Miller (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Nicolas Vigier (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Daniel Kahn Gillmor (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Kurt Seifried (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Dean Pierce (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Grandma Eubanks (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Daniel Micay (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Dean Pierce (Dec 17)