3 ms·
I don't understand what you're implying. This is a 0day that could be exploited from any number of outside channels.
by benwilber0 11y ago
I don't understand what you're implying. This is a 0day that could be exploited from any number of outside channels.
- brazzledazzle 11y agoYou can also use it to build malware that would normally be defeated by an unprivileged account right?
- benwilber0 11y agoA java applet could exploit this. With a little work, a Flash load in Safari (or really any browser) could probably exploit it. This is a real 0day.
- honest_joe 11y agoexcept it's no longer an 0day.
- mmaunder 11y agoGo ahead and give us an example.
- benwilber0 11y agoWhat user does your web browser run as? Do you use chrome? Any Chrome extensions use the NDK?
- ossreality 11y agolmao, something running under the NDK is massively sandboxed and would not be exploitable like this.
- jsprogrammer 11y agoShell script in a git repo?
- deleted 11y ago[deleted]
- mmaunder 11y agoI can't reply to your post lower in the thread, but saying a java applet and flash app can exploit this? It's a C program that requires a local account on the box. You would need to break out of the java sandbox into local unprivileged shell access before you could exploit this via java. Same with flash - you would need a flash exploit that breaks you out of the sandbox before you can exploit this. In other words, you'd need two major vulnerabilities to do what you want to do. That's why I posted a reply saying 'tell us how'. It's important to understand that to exploit this you need a local unprivileged account on the box.
- benwilber0 11y agoJava applet and Flash 0days exist in the wild whether they're published or not. I am confident that 0days for them exist and are actively used right now. So you're going to tell me that this is a non-issue because it's "unexploitable"?
- mmaunder 11y agoI think you spelled 'exploitable' wrong, since that's what I actually said when passing on my complements to the author above. I feel like I'm arguing with a dining room table.
- bro-stick 11y agoit's a major piece of a multi-step own, no doubt. Get write and execute from browser, email client or office doc vulns, and shit's on. Rootkit installed and bot ready to install more payload components.
- fit2rule 11y agoAdd malware to valued homebrew tool, profit.
- ams6110 11y agoeasily exploitable in the mode of many project "installers" these days which is something like: curl <some_url> | bash