bugtraq - Re: Superuser unsanitized environment vulnerability on Android <= 4.2.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5284EFCF.9070301@niisi.msk.ru>
Date: Thu, 14 Nov 2013 19:44:15 +0400
From: "Gleb O. Raiko" <raiko@...si.msk.ru>
To: Kevin Cernekee <cernekee@...il.com>, bugtraq@...urityfocus.com
Subject: Re: Superuser unsanitized environment vulnerability on Android <=
 4.2.x

Kevin,

Considering ChainsDD Superuser you mentioned.
Unfortunately, your mail describes just potential attack vectors. While 
I can't say for sure, Superuser isn't vulnerable at all, I'd like to 
note that su invokes the am script in the process with the credentials 
of the caller, not root. Thus, by manipulating the environment 
variables, file descriptors, signals, etc, the user can get yet another 
process with the same credentials, perhaps, with a shell or with an 
instance of Davlik VM inside.

Regards,
Gleb.