Date: Fri, 26 Aug 2011 10:58:26 +0200 From: Yves-Alexis Perez <corsac@...ian.org> To: Sebastian Krahmer <krahmer@...e.de> Cc: 639151@...s.debian.org, Moritz Muehlenhoff <jmm@...ian.org>, robert.ancell@...onical.com, oss-security@...ts.openwall.com Subject: Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation On ven., 2011-08-26 at 10:43 +0200, Sebastian Krahmer wrote: > Hi, > > You probably dont take into account the chown() that happens in lightdm. > Just unlink the created ~/.dmrc or ~/.Xauthority files after creation and make a symlink > to /etc/passwd to chown it to yourself. The chown will be applied to the symlink, not the target. I've tried to make .Xauthority a symlink to a root-owned file and the destination was indeed destroyed, but it's still root-owned. > However I didnt dig deep enough into it to write an exploit as I dont have > a working lightdm setup. The correct behavior is to temporarily drop euid/fsuid > to that of the user if doing anything with his files. Yeah, I'm currently cooking patches doing that, though they'll need review before apply. > > The PAM issue that I was curious about was that a pam_start() etc is done > for the greeter-user (which I expect to be some "lightdm" user)? Yes > > I would expect all pam_ calls are only done for the user who is actually > about to login. The question that came up to me was whether pam_environment > from the user would have impact on uid-0 called programs/scripts since > you transfer the PAM env to the process env. Yeah, that looks fishy, though I have no idea how it's exactly cooked that way, we'll have to wait for an answer from Robert. Regards, -- Yves-Alexis Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.