New answers tagged

1

From the way you are wording this question and your comments, it sounds like this is a hypothetical. So I will treat it as such. What you've described in your question is privilege escalation: you are starting with a user account, stealing a session cookie, and then using it to escalate your privileges to admin. However this may not be how the vulnerability ...


1

This question continues to receive occasional visits and upvotes, and I see that a few of the answers contain parts of the true answer, so I am creating a wiki answer that stitches it all together. A similar question has since been asked and answered at Unix.SE. According to RH# 1225788, this is intended behavior: It's by design that admin users (in the ...


1

Basically, you will depend on the expert(s) assessing the program security having a deep knowledge of what the programs that are allowed elevated rights can do. The above sentence includes knowledge of the libraries used by the program and the system you are using (Linux? *BSD?). Going down to a full source-code audit may not be needed. For a well-...


1

In general what you can think, instead of binaries is on syscalls. For example cat, more and less probably they will execute the syscalls, open, read, write, close and so on. On the other hand, if the binary (for example find) can execute other binaries, with the use of -exec parameter, the syscalls implied on this process are fork, exec, mmap, etc.. that ...


6

In general, it's impossible to know for sure - even a seemlingly-perfectly-safe program could have vulnerabilities that mean it can be used for arbitrary actions - but here are some things to check for: Does the program do any of the following? Reveal the contents of arbitrary files or devices. Copy, move, write, or delete arbitrary files. Set / modify ...


5

It essentially boils down to the halting problem, you can audit the code or reverse engineer the binary, however even if there are no "features" that let you execute arbitrary commands there could still be vulnerabilities in the binary or sudo itself that could lead to arbitrary command execution as root for the enabled users.


-2

Things are not only binaries! How can one tell if a binary is safe to give sudo permissions for to an untrusted user? Depending on who (is to be protected, and who is able to connect), what (files, directories, file systems, sockets, etc). I think the correct answer is to recommand to search another approach. Nota: Last paragraph of SO question was ...


Top 50 recent answers are included