[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Dec 2014 10:38:26 -0800
From: Dean Pierce <pierce403@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: What is the "Grinch" polkit/wheel group issue?
The key here is the line:
"In order to exploit this, all we need is a single vulnerability in
any package in a repo. There are tons to choose from. If we type
‘PKCon’ or simply ‘man PKCon,’ we can find a list of repos in use and
then pull a list of all bins and version numbers. I won’t provide one
here because you don’t want everything handed to you."
Had they actually found a package they could leverage to get root,
then this would absolutely be a vulnerability, but they didn't. While
configuring pkcon to allow admins to install packages without typing
in a password *is* something that might be unexpected for people
unfamiliar with polkit, that is the exact type of use case it was
built for.
- DEAN
On Wed, Dec 17, 2014 at 10:24 AM, Kurt Seifried <kseifried@...hat.com> wrote:
> On 17/12/14 10:00 AM, Marcus Meissner wrote:
>> Hi,
>>
>> This probably needs a CVE too, or does it have one?
>>
>> https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/
>> http://www.pcworld.com/article/2860032/this-linux-grinch-could-put-a-hole-in-your-security-stocking.html
>>
>> Although it seems that the user is in the "wheel" group for this to be exploitable
>> and is hard to specify what actions should be safed by another query or which should not.
>>
>> Ciao, Marcus
>
> Yeah I looked into this (the article/etc was completely confusing and
> took some time to parse):
>
> 1) the article states they contacted red hat, we were unable to find
> any inbound email or bugzilla entry pertaining to this issue, as always
> if you have an issue you wish to report please contact secalert@...hat.com
>
> 2) this is expected behaviour, admin users can install software (do I
> have to say this? really? yes. I was told I should say this).
>
> 3) don't run web apps as admin users (do I have to say this? really?
> yes. I was told I should say this).
>
> 4) if you feel the need to run a web app as an admin user restrict what
> they can do via SELinux, and don't let them install software (do I have
> to say this? really? yes. I was told I should say this).
>
> So TL;DR: it's not a security vulnerability, and it will NOT be getting
> a CVE.
>
> I can only assume this article/vuln is perhaps referring to something
> like Cpanel and other control panels that people sometimes install
> insecurely/improperly and then never update. Or something. Who knows.
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
