Vulnerability: Unprivileged Linux Users With UID > INT_MAX Can Execute Any Command

Discussion in 'all things UNIX' started by guest, Dec 7, 2018.

  1. guest

    guest Guest

    Unprivileged Linux Users With UID > INT_MAX Can Execute Any Command
    December 6, 2018
    https://thehackernews.com/2018/12/linux-user-privilege-policykit.html
     
  2. mirimir

    mirimir Registered Member

    Joined:
    Oct 1, 2011
    Posts:
    9,252
    Interesting. But only root can create new accounts. And if you have root, why do you need this? To try to hide?
     
  3. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    The problem is with programatically configured applications that may have setuid on account creation.
    Mrk
     
  4. mirimir

    mirimir Registered Member

    Joined:
    Oct 1, 2011
    Posts:
    9,252
    OK, then, so this is just a subset of getting pwned by malicious apps.

    But I guess that it wasn't something code reviewers were looking for, in the past.

    To check:

    Code:
    $ cat /etc/passwd | mawk -F : '{ print $3 }' | sort -n | tail -n 1
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.