bugtraq - Re: Sudo: local root compromise with krb5 enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 Jun 2007 09:00:55 -0600
From: Kyle Wheeler <kyle-bugtraq@...oryhole.net>
To: bugtraq@...urityfocus.com
Subject: Re: Sudo: local root compromise with krb5 enabled

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday, June 11 at 06:52 PM, quoth Ken Raeburn:
>> But sudo has a curious bug: it *tries* to do the second step, but 
>> if that step fails because no local service keys are known, it lets 
>> the user become root anyway, because the (potentially fake) 
>> Kerberos server said so.  For example, on a host without a "keytab" 
>> file:
>
> In some MIT applications there was a conscious choice to that 
> effect.  The MIT library's interface for verifying credentials has a 
> flag that can be set to indicate whether it should return success or 
> failure for this specific case.  (Though personally, I think the 
> default should be the more paranoid one, it would be an incompatible 
> break from previous versions.)

Maybe I'm misunderstanding here, but so what? This sounds like the 
equivalent of this:

     My program respects the $ALLOW_ROOT_COMPROMISE environment 
     variable. You may think root compromises are bad, and that the
     environment variable is ludicrous, and I agree (that "feature" was
     added before I took over), but if I removed it then that would be
     an incompatible break from previous versions.

Just because older programs allowed it doesn't make it sacrosanct.

~Kyle
- -- 
The Son of man came eating and drinking, and they say, "Behold, a 
glutton and a drunkard, a friend of tax collectors and sinners!" Yet 
wisdom is justified by her deeds.
                                                       -- Matthew 11:19
-----BEGIN PGP SIGNATURE-----
Comment: Thank you for using encryption!

iD8DBQFGcVgnBkIOoMqOI14RAkmTAJ9rcBKhRxGyZSeLRgxMnVsmG0GmEwCfYxY0
ZFXlNYUuE3wadtEWnAVF7Iw=
=JdRA
-----END PGP SIGNATURE-----