Re: the su - user thread [Potential Debian Security Issue]
On Tue, 2002-01-22 at 05:26, martin f krafft wrote:
> this is a proof-of-concept post. it's a FreeBSD exploit, thus it may or
> may not have been, be, or will be applicable to Debian Linux or Linux in
> general. you have been warned. properly.
>
> http://www.aerasec.de/security/index.html?id=ae-200201-053&lang=en
I realise now that I have witnessed this kind of issue before ("In some
circumstances, it's possible for a non-privileged process to have `root'
as the login name returned by getlogin.")
Here's how you can reproduce it (running Debian unstable):
1. Log in as root
2. su - user
3. startx (running KDE, not GNOME)
4. Click on the Control Center
5. There in the Control Center info box it will state that the user is
root!
Why does the KDE Control Center think the user is currently root? In
contrast the GNOME Control Center properly identifies the username.
Regards,
Adam
Reply to: