oss-sec mailing list archives
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness
From: halfdog <me () halfdog net>
Date: Mon, 14 Dec 2015 21:14:29 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dag-Erling Smørgrav wrote:
halfdog <me () halfdog net> writes:
http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/
http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/And the PAM issue?
That's the most questionable. Should it be expected from the pam libraries to refuse authentication, when the owner/group of /etc/shadow is completely off? Of course, attacker with possibility to modify ownership of a single file would also find numerous other targets to work on, but should it be so easy? But even when deciding to change behavior, e.g. forcing libpam checks on shadow to be root/[somegroup] and 0640 mode, could that break other existing systems, introduce new (availability) risks? hd - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlZvMSwACgkQxFmThv7tq+791wCZAU+jSCjJffULGkrmriXeCAKd Q7EAnjNmfNRHai3Qt3TqtElgfkck3TPs =ytMn -----END PGP SIGNATURE-----
Current thread:
- User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness halfdog (Dec 02)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness halfdog (Dec 13)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness Dag-Erling Smørgrav (Dec 14)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness halfdog (Dec 14)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness Solar Designer (Dec 14)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness halfdog (Dec 20)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness Dag-Erling Smørgrav (Dec 15)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness halfdog (Dec 15)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness cve-assign (Dec 15)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness Dag-Erling Smørgrav (Dec 14)
- Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness halfdog (Dec 13)