bugGKSu - Bugs: bug #22374, Possible security issue with...

 
 

bug #22374: Possible security issue with --description

Submitted by:  None
Submitted on:  Thu 21 Feb 2008 02:22:37 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 21 Feb 2008 02:22:37 PM UTC, original submission:

The --description option allows you to show a random string instead of the command you are executing. This could facilitate an elevation of privilege for an application that has normal user rights. It can do this by modifying menu entries that use gksu to launch applications with administrative rights. When prompted with the gksu dialog you will see only the provided description, not the command you are running.

Example:
In Ubuntu 7.10 I am able to modify the menu entry for Synaptic Package Manager with normal user rights from
gksu /usr/sbin/synaptic
to something like
gksu --description synaptic /home/user/.sinaptic
, where the .sinaptic script runs some "evil code" and starts the real synaptic.

I propose to show the command gksu is running even if you have a description. Of course, the complete solution probably should include having those menu entries read-only for a normal user, but that is probably a gnome issue.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

No Changes Have Been Made to This Item

Back to the top


Powered by Savane 3.1-cleanup