Bug 143963 – x11-wm/icewm sudo in startup script doesn't require password

• Product: Gentoo Security
• Status: RESOLVED INVALID

[Description phrexianreaper 2006-08-14 21:04:09 UTC]

Summary pretty much sums it up. I had set up a terminal with the IceWM-session startup script to start up with tail on /var/log/messages, and when everything it up and running, it doesn't require a password.

If i'm not mistaken, this could (depending on the way sudoers file is set up) cause a serious problem if an attacker added a series of commands into the script, and cause problems.

[Comment 1 Raphael Marichez (Falco) (RETIRED) 2006-08-16 01:31:37 UTC]

i don't understand why a NOPASSWD: sudo entry is needed to realize a "tail -f /var/log/messages" which is very often world-readable.


If an attacker can modify a user script, he already can execute code with this user permissions, so there's no security issue this side.
Finally, if the /etc/sudoers file is too permissive, it's the problem of the person who edited this file.
Please elaborate :)

[Comment 2 phrexianreaper 2006-08-16 01:39:04 UTC]

Well, I cann't cat /var/log/messages on my system, nor tail it.

It is a user-end problem, but making sure this kind of thing is shown. Too permissive a sudoer file can be dangerous, but it is STILL a problem. I havn't fully tested this kind of thing, so I'll get back to you when I can test it out better, but it is still a possible problem that I will also bring up with the IceWM devs.

Currently I'm updating to gcc-4.1.1, so I'll have to do this a little later on, but I'll get some more info to see how bad a problem this could be

[Comment 3 Raphael Marichez (Falco) (RETIRED) 2006-08-16 02:21:37 UTC]

> but I'll get some more info to see how bad a problem this could be
> 


yes, please tell us what it is possible to do for an attacker in the default sudoers config.

[Comment 4 Sune Kloppenborg Jeppesen (RETIRED) 2006-09-05 06:30:44 UTC]

Any news on this one?

[Comment 5 Tavis Ormandy (RETIRED) 2006-09-05 06:33:27 UTC]

marking INVALID, you probably entered your password and it hadnt timed out, or you have entered a NOPASSWD line.

[Comment 6 phrexianreaper 2006-09-05 07:10:46 UTC]

Apparently it has been solved. Don't know exactly why, but it seems to be.

The only diffrence I made that would affect this is in the sudoers file I moved gpm to a NOPASSWD entry, and listed the rest after PASSWD, including tail.

Sorry for the lack of replies, I've been rather busy with other things.