bugGKSu - Bugs: bug #25114, Security: running gksu(do) on...

 
 

bug #25114: Security: running gksu(do) on another display

Submitted by:  None
Submitted on:  Wed 17 Dec 2008 04:13:06 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 17 Dec 2008 04:13:06 PM UTC, original submission:

If you open a terminal another place than your current desktop and log on with the same user you are able to make gksudo run on the other display doing something like the following:

$ export DISPLAY=:0.0
$ gksudo sh damagingScript.sh

This can be used to get unauthorized root-access and should be prevented.

Eg. if you're somehow able to get access to an user account (ie. through an ftp bug) you would be able to show the gksudo on another display and if the script running is named something with update most users would probably think it's ok and type the password.

// Rohde Fischer, -unavailable-

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

No Changes Have Been Made to This Item

Back to the top


Powered by Savane 3.1-cleanup