desktop-packages team mailing list archive

[Tyler Hicks <tyhicks@xxxxxxxxxxxxx>]

Hi Mark - I've taken a look at the details in this bug, the upstream
sudo bug, the /r/linux thread, and the upstream sudo fix. I appreciate
and respect your thoroughness.

After taking all of the details into account, I consider this issue to
be low severity due to the mitigating factors involved. Specifically, I
don't see a way for an attacker, without physical access, to use an
arbitrary code execution vulnerability in combination with the issue
that you've described in this bug to elevate his/her privileges.
Considering this, the attack requires an admin user leave his/her
desktop session unlocked and for an attacker to come across this
unlocked desktop session. Since there are many different ways to attack
an unlocked desktop session, best security practices dictate all users
lock their screens when not at their computer.

We will fix this issue in the next Ubuntu release (15.10) by including
sudo 1.8.10 or newer.  Due to the issue’s low severity and considering
our practice of prioritizing resources on publishing security updates
that fix issues of greater security impact, we may fix this issue in
stable releases of Ubuntu in the future if another sudo vulnerability of
higher severity is found or if new details emerge regarding this issue.

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to policykit-desktop-privileges in Ubuntu.
https://bugs.launchpad.net/bugs/1219337

Title:
  Users can change the clock without authenticating, allowing them to
  locally exploit sudo.

Status in Cinnamon:
  New
Status in sudo:
  Unknown
Status in Unity:
  Invalid
Status in policykit-desktop-privileges package in Ubuntu:
  Opinion
Status in sudo package in Ubuntu:
  Confirmed
Status in policykit-desktop-privileges source package in Precise:
  Opinion
Status in sudo source package in Precise:
  Confirmed
Status in policykit-desktop-privileges source package in Trusty:
  Opinion
Status in sudo source package in Trusty:
  Confirmed
Status in policykit-desktop-privileges source package in Utopic:
  Opinion
Status in sudo source package in Utopic:
  Confirmed
Status in policykit-desktop-privileges source package in Vivid:
  Opinion
Status in sudo source package in Vivid:
  Confirmed

Bug description:
  Under unity and cinnamon, it is possible for a user to turn off
  network-syncronized time and then change the time on the system. It is
  also possible to "cat /var/log/auth.log" and find the last time a user
  authenticated with sudo, along with which pty they used. If a user had
  used a terminal and successfully authenticated with sudo anytime in
  the past, and left the sudo file in "/var/lib/sudo/<username>/", a
  malicious user could walk up to an unlocked, logged in machine and
  gain sudo without knowing the password for the computer.

  To do this, a user would only need to launch a few terminals, figure
  out which pty they were on via "tty", find the an instance in
  /var/log/auth.log where sudo was used on that PTY, and set the clock
  to that time. Once this is done, they can run (for example) "sudo -s"
  and have a full access terminal.

  1) This has been observed on Ubuntu 13.04, and may work on other versions.
  2) This may have an effect on various window managers, but I confirmed it on Unity and Cinnamon
  3) I expected to have to authenticate when I changed the time and date, as I do on Gnome and KDE. I also expected to be denied permission to auth.log
  4) I was able to change the system time to whatever I wanted, and view auth.log. This was sufficient to access sudo without having to type my password.

  Note: This bug also affects any version of OS X, though the mechanism
  is different. Some versions don't require you to authenticate to
  change the time through the GUI, but some do. No version I've seen
  requires authentication to use the "systemsetup" command, which can
  alter the time from the command line. This may be an overall bug in
  sudo. Why can I bypass security by changing the time?!

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinnamon-desktop/+bug/1219337/+subscriptions