Re: Are `su user' and/or `sudo -u user sh' considered dangerous?

[Jakub Wilk <jwilk () jwilk net>]

* Georgi Guninski <guninski () guninski com>, 2018-06-13, 12:54:
> > Is there POC for relatively new distros?
> debian 8 and 9 are vulnerable to su - hostile:
> https://j.ludost.net/blog/archives/2018/06/13/ancient_su_-_hostile_vulnerability_in_debian_8_and_9/index.html

(Please fix unescaped "<" and "&" characters on that page.)

For Debian this bug is tracked here:
https://bugs.debian.org/628843

> what about the second potential vulnerability: reading root's tty after 
> the session is closed with something like tee(1) ?

The list of nasty things you can do when you get your hands on the tty 
fd is probably very long...

> several sources suggest disabling TIOCSTI or using setsid(), are they 
> enough?

setsid() defeats TIOCSTI (while breaking other things like job 
control...); it doesn't stop other attacks that don't require 
controlling terminal.

Until su is fixed to allocate new pty, I recommend running it under a 
standalone terminal emulator, such as screen or tmux. This has also an 
advantage that it's possible to tell that the invoked program actually 
terminated, instead of just pretending to terminate and faking root 
shell UI.

--
Jakub Wilk