From: Valdis.Kletnieks@vt.edu
To: Manuel Reimer <Manuel.Spam@nurfuerspam.de>
Cc: linux-kernel@vger.kernel.org
Subject: Re: Do people exaggerate in security advisories?
Date: Fri, 04 Jan 2008 15:28:08 -0500 [thread overview]
Message-ID: <20820.1199478488@turing-police.cc.vt.edu> (raw)
In-Reply-To: Your message of "Fri, 04 Jan 2008 13:21:32 +0100." <fll7u3$p02$1@ger.gmane.org>
[-- Attachment #1: Type: text/plain, Size: 981 bytes --]
On Fri, 04 Jan 2008 13:21:32 +0100, Manuel Reimer said:
> Is it really possible to get root privileges with this bug or are there
> people who just write "may be used to escalate privileges" near any bug
> which has something to do with "setuid" or "setgid"?
It looks like it really *is* possible to do some damage, if you can make
several things happen:
1) Cause set[ug]id() to fail, possibly using a crafted 'capabilities' list.
2) Get it to invoke a helper that's now running with different permissions than
it was designed to, and feed said helper some carefully crafted malicious or
bogus data.
Given that it is semantically almost identical to the Sendmail-capabilities
bug from a few years ago, which was *certainly* abusable to get root, it would
be foolish to think anything *except* "this sucker should be assumed to be
a root exploit until *proven* otherwise". Anybody who thinks "I don't see
how to exploit it, so it can't be done" is in for a rude surprise....
[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]
prev parent reply other threads:[~2008-01-04 20:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-01-04 12:21 Manuel Reimer
2008-01-04 16:50 ` Manuel Reimer
2008-01-04 20:28 ` Valdis.Kletnieks [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20820.1199478488@turing-police.cc.vt.edu \
--to=valdis.kletnieks@vt.edu \
--cc=Manuel.Spam@nurfuerspam.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®