5 ms·
It's just a list of binaries that have the potential to be used by exploits. There's nothing inherently wrong with many of the privileges if they are absolutel
by blihp 7y ago
It's just a list of binaries that have the potential to be used by exploits. There's nothing inherently wrong with many of the privileges if they are absolutely necessary to do the job... which often they are unless either functionality is removed/disabled or the executable or parts of the system rearchitected.
By keeping track of the potential exposure of such binaries one can 1) continuously ask the question 'what needs to be done to mitigate/eliminate these potential attack vectors?' (an example would be the changes to Xorg to eliminate the need to run with root privileges) and 2) help security conscious admins keep on top of the risks they are potentially exposing themselves to when installing/allowing use of said binaries in various situations. (such as not allowing the use of these binaries in restricted shell scenarios... or at least being aware of the potential risks and and making an informed decision vs. inadvertently putting the system at risk)
- Topgamer7 7y agoSo for example the aria2c application listed. Unless you either have a script or process that runs it via sudo, or uses chmod +s on it, you're in the clear (barring other vulns)?
- schoen 7y agoAn example could be that a user is allowed to run aria2c via sudo in the /etc/sudoers file (perhaps with certain restrictions described there). If that user's account is compromised, the attacker could then potentially use the technique mentioned here to escalate to root or to the user as whom /etc/sudoers permits aria2c to be run, at least if the sudoers file didn't forbid the invocation that accomplish the escalation. One angle you could think about is "if I'm a system administrator writing an /etc/sudoers file and I want to allow users to do certain tasks, am I then inadvertently allowing them to do other completely unrelated tasks, perhaps in an entirely nonintuitive way"? Edit: a very nice example is https://news.ycombinator.com/item?id=20648960 https://news.ycombinator.com/item?id=20648960, downthread.