I'm reading this and I'm little confused. What exactly is this setuid based script root spoofing?
This is a theoretical attack that could allow a user to elevate their privileges to root.
Say we have a setuid-root
When the script is executed, the OS reads the first line, the uses that program to run the script. The command it will execute is:
A twist on setuid scripts is that a user can create a link to the script, say
However, bash and Linux have a number of other defences that make this impractical. For example, the command on Linux would be
All of this only applies if you have a setuid-root shell script. This is not recommended anyway - for these reasons and more. In fact, on Linux you can't have setuid shell scripts at all.
If you're interested in this area in general, Nebula is worth a look.