full-disclosure - [FD] Hue 3.7.1 Local Privilege Escalation

Open Source and information security mailing list archives

Message-ID: <CAN78G5pmbnpHjKOtEGj2oXKruX2g7p=Pg3Ewu5fdJeRhHNm7VA@mail.gmail.com>
Date: Thu, 14 May 2015 14:25:10 +0200
From: Julian Horoszkiewicz <ewilded@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Hue 3.7.1 Local Privilege Escalation

Title: Hue 3.7.1 Local Privilege Escalation
Author: Julian Horoszkiewicz
Description:
An issue with hue-root privilege separation model has been identified. The
reason for this is that /usr/lib/hue/build/env/bin/supervisor python script
is by default owned by user hue, but executed as root. That opens the way
for adding arbitrary commands to be executed as root if one has access to
hue user account.
The hue server itself runs with privileges of the dedicated user hue (it
drops privileges from root), nonetheless privilege reduction takes place
scarcely after execution of the culprit script, which leads to privilege
escalation. Either manual service restart by root or system reboot has to
be performed in order to get the malicious code executed. In order to
mitigate the risk, the ownership of that file should be changed to root.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives