bugGKSu - Bugs: bug #25114, Security: running gksu(do) on...

 
 

bug #25114: Security: running gksu(do) on another display

Submitter:  None
Submitted:  Wed 17 Dec 2008 04:13:06 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 17 Dec 2008 04:13:06 PM UTC, original submission:  

If you open a terminal another place than your current desktop and log on with the same user you are able to make gksudo run on the other display doing something like the following:

$ export DISPLAY=:0.0
$ gksudo sh damagingScript.sh

This can be used to get unauthorized root-access and should be prevented.

Eg. if you're somehow able to get access to an user account (ie. through an ftp bug) you would be able to show the gksudo on another display and if the script running is named something with update most users would probably think it's ok and type the password.

// Rohde Fischer, -email is unavailable-

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

No changes have been made to this item

Back to the top

Powered by Savane 3.13-3230.
Corresponding source code