Date: Fri, 13 Jan 2017 20:55:42 +0100 From: Thomas Deutschmann <whissi@...too.org> To: oss-security@...ts.openwall.com Subject: Re: Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] On 2017-01-13 19:26, Carlos Alberto Lopez Perez wrote: > /me happy to know that logrotate has a sane behaviour and avoids > trying to rotate symlinks. But don't forget hardlinks ... > So the issue is than when in var/log/nginx/ there are standard logs > (non symlinked) that need to be rotated (appart from the malicious > symlinked one), then logrotate will rotate those ones, finally > running the post-rotate script that send SIGURSR1 to the nginx pid. Just to be sure that we don't misunderstand each other: Dawid's advisory only uses logrotate because this is present on most servers and guarantees privilege escalation on a given time which makes it easier to understand. But escalation happens via nginx master process which is running as root and changes owner of existing files. Without logrotate you can still exploit any system when you can write to the directory used by nginx for storing log files (and don't forget your vhosts!). The attacker only have to wait an undefined amount of time, i.e. for anyone causing nginx to chown files again. On systems running nginx it is not the question *if* it will happen but only *when*. -- Regards, Thomas Deutschmann Download attachment "signature.asc" of type "application/pgp-signature" (952 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.