RE: [cobalt-security] fun with /usr/lib/authenticate

["Graeme Fowler" <graeme.fowler@xxxxxxxxxxxxxx>]

Jonathan Michaelson wrote:

> Tried the exploit on an up to date RaQ4 and the exploit
> did not work. It was able to do everything except the
> most important bit which was to get a CRON job to run
> to allow root access. Maybe the exploit is crippled?

In the best tradition of public full disclosure, indeed it is. You need a smattering of shell scripting knowledge to work out where the fault is. And if you read your email after running the script, it's made extremely clear ;-)

The fix is almost made extremely clear inside the exploit script.

BTW I ran it on a patched right-up-to-the-one-before-the-SHP debacle RaQ4, and it worked right-out-the-box. I have, however, long since ceased to be surprised by these things. In my experience, if you have interactive shell access as any user, you have root already.

Lesson to be learned here is: don't give users shell access, unless you absolutely trust them.

Graeme
-- 
Graeme Fowler
System Administrator
Host Europe Group PLC