lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 2 Dec 2012 21:36:04 +0100 From: king cope <isowarez.isowarez.isowarez@...glemail.com> To: Yves-Alexis Perez <corsac@...ian.org> Cc: oss-security@...ts.openwall.com, Kurt Seifried <kseifried@...hat.com>, full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, todd@...ketstormsecurity.org, submit@...sec.com, Mitre CVE assign department <cve-assign@...re.org>, Steven Christey <coley@...re.org>, security@...iadb.org, security@...ql.com, Ritwik Ghoshal <ritwik.ghoshal@...cle.com>, moderators@...db.org Subject: Re: [oss-security] Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday Correct, I tell that from experience because I've seen many configurations where the least privileged user has file privs enabled. If we leave it that way the attackers will be more happy, it's not decision to patch it or not, just a hint . Regard, Kingcope 2012/12/2 Yves-Alexis Perez <corsac@...ian.org>: > On dim., 2012-12-02 at 21:17 +0100, king cope wrote: >> My opinion is that the FILE to admin privilege elevation should be patched. >> What is the reason to have FILE and ADMIN privileges seperated when >> with this exploit >> FILE privileges equate to ALL ADMIN privileges. > > Maybe because you might not want admins to have read/write access to the > filesystem anyway? > > Regards, > -- > Yves-Alexis
Powered by blists - more mailing lists