/bin/login gives root to group utmp

2008-12-01 / 2008-12-02
Credit: Paul Szabo
Risk: High
Local: Yes
Remote: No
CWE: CWE-59


CVSS Base Score: 7.2/10
Impact Subscore: 10/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

There is a group-utmp-to-root privilege escalation vulnerability in /bin/login in Debian, and I expect in all other Linux distros. For details and exploit please see http://bugs.debian.org/505271 Currently am not aware of any group utmp issues (that could be leveraged to get root). Cheers, Paul Szabo psz@maths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia

References:

http://xforce.iss.net/xforce/xfdb/47037
http://www.securityfocus.com/archive/1/archive/1/498769/100/0/threaded
http://www.milw0rm.com/exploits/7313
http://bugs.debian.org/505271
http://bugs.debian.org/505071
http://bugs.debian.org/332198


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top