bugGKSu - Bugs: bug #25114, Security: running gksu(do) on...


bug #25114: Security: running gksu(do) on another display

Submitted by:  None
Submitted on:  Wed 17 Dec 2008 04:13:06 PM UTC  
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Wed 17 Dec 2008 04:13:06 PM UTC, original submission:  

If you open a terminal another place than your current desktop and log on with the same user you are able to make gksudo run on the other display doing something like the following:

$ export DISPLAY=:0.0
$ gksudo sh damagingScript.sh

This can be used to get unauthorized root-access and should be prevented.

Eg. if you're somehow able to get access to an user account (ie. through an ftp bug) you would be able to show the gksudo on another display and if the script running is named something with update most users would probably think it's ok and type the password.

// Rohde Fischer, -email is unavailable-



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




No changes have been made to this item

Back to the top

Powered by Savane 3.5