3 ms·

if i understood this right: code execution - yes, but no privilege escalation?

by stefs 10y ago

daveloyall 10y ago
Code execution only. Bear in mind the victim doesn't need to OPEN the .mp3 file... See the part of the article about the 'auto thumbnail' feature. I would guess that a crafty attacker could package additional content inside the mp3 file, perhaps some local privilege escalation code...
j_s 10y ago
I too would appreciate further insight in this specific aspect of this vulnerability. Perhaps with the amount of flexibility apparently available it wouldn't take much work to gain root access. There are many parallels here to the libstagefright media codec vulnerabilites that were big news in the Android world back in 2015 - the primary problem seems to be remote code execution, not privilege escalation.
- mikeash 10y ago
  It gives you the ability to run arbitrary code with the same privileges as the media player. Going beyond that would require exploiting some other vulnerability to gain root access. That probably wouldn't be too hard. Local privilege escalation seems to be a lot easier to accomplish. It's harder to secure a system from code running on it than from data coming in from the outside. It's sort of a bigger version of the article's suggestion to "watch out for scripting in unexpected places!" You also don't necessarily need privilege escalation to do a lot of damage. If the media player isn't sandboxed in some way, then it'll have full privileges to access all your user's files. Traditional UNIX permissions means that you need special access in order to write to the kernel, but not to read your e-mails or that spreadsheet you have with your bank account details.
pantalaimon 10y ago
https://xkcd.com/1200/ https://xkcd.com/1200/
prewett 10y ago
My understanding is that code execution is tantamount to getting root, because there's always something to exploit. But for practical purposes, running a botnet as a user and running a botnet as root end up accomplishing about the same thing.
kybernetyk 10y ago
Yes, but if you consider on what systems people listen to music (personal computers, not servers) then unprivileged code execution can be actually pretty serious. You could get access to their email. You could steal their private SSH keys. Steal the browser's cookie cache. Get access to their password manager. Pull API keys out of private code bases. etc. So I wouldn't shrug it off.

if i understood this right: code execution - yes, but no privilege escalation?

by stefs 10y ago

if i understood this right: code execution - yes, but no privilege escalation?

Code execution only. Bear in mind the victim doesn't need to OPEN the .mp3 file... See the part of the article about the 'auto thumbnail' feature. I would guess that a crafty attacker could package additional content inside the mp3 file, perhaps some local privilege escalation code...

j_s 10y ago

I too would appreciate further insight in this specific aspect of this vulnerability. Perhaps with the amount of flexibility apparently available it wouldn't take much work to gain root access. There are many parallels here to the libstagefright media codec vulnerabilites that were big news in the Android world back in 2015 - the primary problem seems to be remote code execution, not privilege escalation.

mikeash 10y ago
It gives you the ability to run arbitrary code with the same privileges as the media player. Going beyond that would require exploiting some other vulnerability to gain root access. That probably wouldn't be too hard. Local privilege escalation seems to be a lot easier to accomplish. It's harder to secure a system from code running on it than from data coming in from the outside. It's sort of a bigger version of the article's suggestion to "watch out for scripting in unexpected places!" You also don't necessarily need privilege escalation to do a lot of damage. If the media player isn't sandboxed in some way, then it'll have full privileges to access all your user's files. Traditional UNIX permissions means that you need special access in order to write to the kernel, but not to read your e-mails or that spreadsheet you have with your bank account details.

pantalaimon 10y ago

https://xkcd.com/1200/ https://xkcd.com/1200/

prewett 10y ago

My understanding is that code execution is tantamount to getting root, because there's always something to exploit. But for practical purposes, running a botnet as a user and running a botnet as root end up accomplishing about the same thing.

kybernetyk 10y ago

Yes, but if you consider on what systems people listen to music (personal computers, not servers) then unprivileged code execution can be actually pretty serious. You could get access to their email. You could steal their private SSH keys. Steal the browser's cookie cache. Get access to their password manager. Pull API keys out of private code bases. etc. So I wouldn't shrug it off.