Jump to content

Ubuntu fixes bugs that standard users could use to become root


securitybreach

Recommended Posts

securitybreach

Wow, that is a serious bug. Good thing that it got fixed.

 

Quote

Ubuntu developers have fixed a series of vulnerabilities that made it easy for standard users to gain coveted root privileges.

 

“This blog post is about an astonishingly straightforward way to escalate privileges on Ubuntu,” Kevin Backhouse, a researcher at GitHub, wrote in a post published on Tuesday. “With a few simple commands in the terminal, and a few mouse clicks, a standard user can create an administrator account for themselves.”

 

The first series of commands triggered a denial-of-service bug in a daemon called accountsservice, which as its name suggests is used to manage user accounts on the computer. To do this, Backhouse created a Symlink that linked a file named .pam_environment to /dev/zero, changed the regional language setting, and sent accountsservice a SIGSTOP. With the help of a few extra commands, Backhouse was able to set a timer that gave him just enough time to log out of the account before accountsservice crashed.


When done correctly, Ubuntu would restart and open a window that allowed the user to create a new account that—you guessed it—had root privileges. 

 

 

 

https://arstechnica.com/information-technology/2020/11/ubuntu-fixes-bugs-that-standard-users-could-use-to-become-root/

  • Agree 1
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...