Re: SuSE Linux K-Menu YAST Control Center Priviledge Escalation Vulnerability

[Radoslav Dejanović]

On Friday 06 August 2004 04:45, Jordan Pilat wrote:
> 'Menus' tab of the K menu panel preferences),
> however, one can not only access, but make changes to
> the options in the YAST control center without having
> to authenticate as root.

Just tried it, it seems that it allows you just to make changes that are=20
allowed to unprivileged user; modules that require authentication will=20
fail at some point (writing to /etc, installing or removing software,=20
enabling/disabling services...). I have tested online update, add/remove=20
software, Samba and firewall and they all failed. It does pose some risk,=20
however, for it might allow unprivileged user to take a look at some data=20
that should be hidden from the user (for example, you can look at firewall=
=20
settings but can't make changes).=20

On the other hand, you can start yast from console with -firewall switch=20
and have a peek at the settings (still can't make changes), so this isn't=20
KDE fault but flaw in yast itself. It would be wise to add some paranoia=20
to yast so it won't show sensitive data to unprivileged user. =20

=2D-=20
Radoslav Dejanovi=C4=87
Operacijski sustavi d.o.o.
http://www.opsus.hr

[Matthias Leisi]

Radoslav Dejanović wrote:

> It does pose some risk,
> however, for it might allow unprivileged user to take a look at some data
> that should be hidden from the user (for example, you can look at firewall
> settings but can't make changes).

But if the user is allowed to read this file (eg. somewhere in /etc)
through Yast, then he can read it anyway, let's say through less.


> On the other hand, you can start yast from console with -firewall switch
> and have a peek at the settings (still can't make changes), so this isn't
> KDE fault but flaw in yast itself. It would be wise to add some paranoia
> to yast so it won't show sensitive data to unprivileged user.

Which is a bad idea, since it merely hides the problem.

-- Matthias

--
Brain-Log http://matthias.leisi.net/