oss-security - Re: gksu-polkit

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 15 Mar 2011 09:47:13 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: kov@...ian.org, coley <coley@...re.org>
Subject: Re: gksu-polkit

I assigned this CVE-2011-0703 when you sent it to vendor-sec.

Thanks.

-- 
    JB

----- Original Message -----
> Hi,
> 
> I already sent this to vendor-sec a while ago (cant remember
> whether this already received a CVE and which) as well as to
> the maintainer (Cc) which did not yield a response.
> So I send it here again. Merging X cookies is probably not
> a good idea by itself for sudo like programs but this problem
> adds more.
> 
> Sebastian
> 
> -------------------------->8----------------------
> 
> While reviewing possible replacements for libgnomesu, I found that
> the gksu-polkit contains a weird vulnerability that allows
> to escalate privileges.
> 
> Basically the gksu-server is a DBUS activation that runs as root.
> Users invoke the Spawn method via DBUS and gksu-server components
> check via polkit whether the user is allowed to run the program.
> 
> Despite the "nice" architecture involving dozens of glib, dbus etc.
> libs for such a simple purpose as well as running Vala generated
> source code
> as root, it has an inlining problem.
> gksu-server tries to merge the X11 cookie credentials via xauth
> commands.
> It creates a script file (as root) which it passes to xauth like so:
> 
> 
> gboolean gksu_controller_prepare_xauth()
> {
> [...]
> xauth_display = g_hash_table_lookup(environment, "DISPLAY");
> [...]
> xauth_cmd = g_strdup_printf("add %s . %s\n", xauth_display,
> xauth_token);
> fwrite(xauth_cmd, sizeof(gchar), strlen(xauth_cmd), file);
> [...]
> command = g_strdup_printf("%s -q -f %s source %s", xauth_bin,
> xauth_file, tmpfilename);
> 
> g_spawn_command_line_sync(command, NULL, NULL, &return_code, &error);
> [...]
> }
> 
> 
> 
> while the creation of the tmp file looks safe, the DISPLAY variable
> might
> be passed by the user to the Spawn DBUS method. It may contain
> newlines,
> spaces etc. since the default common.variables file allows to pass
> unrestricted data via DISPLAY to it.
> Therefore the source file for xauth may contain arbitrary commands,
> e.g. extracting user owned X11 cookies to root's .Xauthority
> or to /etc/passwd. He may then overtake a administrator X11 session
> since his cookies have been placed to /root/ or "carefully chooses"
> a token that matches a /etc/passwd entry.
> Same maybe applies to xauth_token which might contain newlines etc.
> 
> The default config must contain regex that forbid such characters or
> the token handling inside gksu-server has to be done differently.
> 
> 
> 
> --
> ~
> ~ perl self.pl
> ~ $_='print"\$_=\47$_\47;eval"';eval
> ~ krahmer@...e.de - SuSE Security Team
> ~ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.