未加星标

Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems

字体大小 | |
[系统(linux) 所属分类 系统(linux) | 发布者 店小二03 | 时间 2018 | 作者 红领巾 ] 0人收藏点击收藏

Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems

A vulnerability that is trivial to exploit allows privilege escalation to root level on linux and BSD distributions using X.Org server, the open source implementation of the X Window System that offers the graphical environment.

The flaw is now identified as CVE-2018-14665 (credited to security researcher Narendra Shinde ). It has been present in xorg-server for two years, since version 1.19.0 and is exploitable by a limited user as long as the X server runs with elevated permissions.

Privilege escalation and arbitrary file overwrite

An advisory on Thursday describes the problem as an "incorrect command-line parameter validation" that also allows an attacker to overwrite arbitrary files.

Privilege escalation can be accomplished via the -modulepath argument by setting an insecure path to modules loaded by the X.org server. Arbitrary file overwrite is possible through the -logfile argument, because of improper verification when parsing the option.

Bug could have been avoided in OpenBSD 6.4

OpenBSD, the free and open-source operating system with a strong focus on security, uses xorg. On October 18, the project released version 6.4 of the OS, affected by CVE-2018-14665. This could have been avoided, though.

Theo de Raadt, founder and leader of the OpenBSD project, says that X maintainer knew about the problem sinceat least October 11. For some reason, the OpenBSD developers received the message one hour before the public announcement this Thursday, a week after their new OS release.

"As yet we don't have answers about why our X maintainer (on the Xsecurity team) and his team provided information to other projects (somewho don't even ship with this new X server) but chose to not give us aheads-up which could have saved all the new 6.4 users a lot of grief," Raadt says .

Had OpenBSD developers known about the bug before the release, they could have taken steps to mitigate the problem or delay the launch for a week or two.

To remedy the problem, the OpenBSD project provides a source code patch , which requires compiling and rebuilding the X server.

As a temporary solution, users can disable the Xorg binary by running the following command:

chmod u-s /usr/X11R6/bin/Xorg Trivial exploitation

CVE-2018-14665 does not help compromise systems, but it is useful in the following stages of an attack.

Leveraging it after gaining access to a vulnerable machine is fairly easy. Matthew Hickey, co-founder, and head of Hacker House security outfit created and published an exploit, saying that it can be triggered from a remote SSH session.

OpenBSD #0day Xorg LPE via CVE-2018-14665 can be triggered from a remote SSH session, does not need to be on a local console. An attacker can literally take over impacted systems with 3 commands or less. exploit https://t.co/3FqgJPeCvO pic.twitter.com/8HCBXwBj5M

― Hacker Fantastic (@hackerfantastic) October 25, 2018

Three hours after the public announcement of the security gap, Daemon Security CEO Michael Shirk replied with one line that overwrote shadow files on the system. Hickey did one better and fit the entire local privilege escalation exploit in one line.

I raise you and fit entire exploit in one line & tweet ;-) https://t.co/OmUkIQdNcK

― Hacker Fantastic (@hackerfantastic) October 25, 2018

Apart from OpenBSD, other operating systems affected by the bug include Debian and Ubuntu , Fedora and its downstream distroRed Hat Enterprise Linuxalong with its community-supported counterpart CentOS .

本文系统(linux)相关术语:linux系统 鸟哥的linux私房菜 linux命令大全 linux操作系统

代码区博客精选文章
分页:12
转载请注明
本文标题:Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems
本站链接:https://www.codesec.net/view/611514.html


1.凡CodeSecTeam转载的文章,均出自其它媒体或其他官网介绍,目的在于传递更多的信息,并不代表本站赞同其观点和其真实性负责;
2.转载的文章仅代表原创作者观点,与本站无关。其原创性以及文中陈述文字和内容未经本站证实,本站对该文以及其中全部或者部分内容、文字的真实性、完整性、及时性,不作出任何保证或承若;
3.如本站转载稿涉及版权等问题,请作者及时联系本站,我们会及时处理。
登录后可拥有收藏文章、关注作者等权限...
技术大类 技术大类 | 系统(linux) | 评论(0) | 阅读(66)