Slashdot Mirror
Grinch Vulnerability Could Put a Hole In Your Linux Stocking
itwbennett writes In a blog post Tuesday, security service provider Alert Logic warned of a Linux vulnerability, named grinch after the well-known Dr. Seuss character, that could provide attackers with unfettered root access. The fundamental flaw resides in the Linux authorization system, which can inadvertently allow privilege escalation, granting a user full administrative access. Alert Logic warned that Grinch could be as severe as the Shellshock flaw that roiled the Internet in September.
Update: 12/19 04:47 GMT by S : Reader deathcamaro points out that Red Hat and others say this is not a flaw at all, but expected behavior.
Also check out Red Hat Knowledgebase article on this too.
How about some actual details about the vulnerability ?
"Oh no, Linux includes a "wheel" user group by default that grants superuser privileges to users in it! And someone could possibly add themselves to that group and gain root access!"
I have both a user password and a root password for my system.
Its afflicted with the ominous.. horrid "User Pilot Error" Malware Softbody Virus
It's completely vulnerable to Idiotic Users and Shrill Security Trolls
In the immortal words of George Takei.. Oh My!!!
Adding users to a group is done by a root user with full permission.... In other news: Administrative user that installs back door leads to back door being installed! Administrative user that changes password on system and puts that password in the MOTD effectivly gives full permissions to everyone who can read that MOTD And the whole calling it "Grinch" thing... like some stuck up jackass "I'll show you Linux, you're not secure! I'll ruin Christmas!" He's the true Grinch.
I get the impression this means that we're looking at a PEBKAC issue rather than a software bug. Sorry, I know of no OS which can be secured against PEBKAC exploits.
Also, to exploit the PEBKAC error requires the Chair to be locally attached via the system console. Uh, hate to bust your bubble guys, but if somebody has console access (physical access) to a server they OWN that server for all practical purposes. I'm surprised they didn't note the "insert a CD and reboot" exploit for hacking a system - it's about as usable and extremely well documented.
For trying to steal some of the IT spotlight on Linux, but you'll never dampen our GNU spirit--largely because this vulnerability isn't really a big deal and most of us who use it are educated enough to know that.
The original author has written pieces for many publications, as he has a university degree in writing. He could have written stories about medicine, or law, or cooking. Instead Joab Jackson writes about computer stuff. He is always itching for a good story (one that gets a lot of eyeballs and makes his publisher smile and say "good job Jack!"). In this case, a sensational headline, and what looks like a menacing scoop. But is it the Shellshock bug? Is it the Heartbleed bug? No. Its normal behavior on a RedHat system (doesn't affect any other flavor of Linux), and worse, its expected, documented, normal behaviour on those systems. But there is no story in "expected behaviour", so we add just a dash of "Sensational Headline" and ignore relevant facts, and *Presto Chango* we have eyeballs and the publisher saying "good job Jack!" And it gets picked up by /. because their editorial department is some guy from Dice who doesn't fact check any of this 'pewter stuff anyway, and its Thursday before Christmas and we need a few inches of publication space burning a hole in the pocket, and if we can get people worried about Linux just before the Christmas buying season, then they will run to the ever luvin' arms of mickeysoft instead of finally switching and saving by using Linux. Sure its a plant piece and unethical. But since its the world of business, the ethics department was de-funded by accounting so we don't have to worry about that anymore.
The flaw we're seeing here is various "computer security journalists" (and journals) destroying their reputations.
This is on the order of discovering that big heavy things that fall on your foot can cause pain.
So is ShellShock fixed now?
I gathered the basic variant is, but then people developed other variants.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
"Alert Logic warned that Grinch could be as severe as the Shellshock flaw that roiled the Internet in September"
While a big deal, Shellshock was very limited in scope and the large scale exploit implications were stamped out very quickly through updates to vulnerable web front-ends (which was just about the only exploitable path, despite so many proclamations that the sky was falling and every internet-connected linux device will get rooted in a matter of days). If this is as severe as Shellshock, I will take notice but at the same time sigh that it's not going to be very bad at all.
[quote]n a blog post Tuesday, security service [b]provider[/b][/quote]
and that's where I stopped reading...
I've never before heard of you, but now you've made the world aware of your incompetence. We can safely just ignore everything from them as non-news. If I see anything "new" from you, I'll know it's utter garbage. Thank you for making that an easy choice.
'we know that any user in the wheel group has “most” admin privileges'
.. This isn't something you hand out to everybody."
...
"Local administrators are trusted users
So, you have to be an administrator in order to achieve administrator level
This article is a better one. Less fear-hype, more reason:
http://blog.threatstack.com/the-linux-grinch-vulnerability-separating-the-fact-from-the-fud
This seems to be more clickbait then anything else. How did this get onto slashdot?
just how many obscure daemons does SystemD have now a days?
Good people go to bed earlier.
Seems to me that if you are a "local user", which is someone with access to the actual keyboard of the server, you likely have direct access to the actual server itself, which is even more a security risk.
Yes, in the first hours there were various workarounds and fixes suggested, and people came up with ways to get around those first workarounds. About 48 hours after the release, consensus congealed around using Red Hat's fix.
There is a very limited set of cases where it could be a compatibility issue if you had custom scripts relying on the old behavior, but that was judged to be fairly insignificant.
Can we vote the ARTICLE down so it will go away? Or change the headline/summary? Nothing like spreading yet more false security FUD. :(
I make it a point to ignore the ignorant. TTFN, Al.
From the oss-sec mailing list:
http://www.openwall.com/lists/...
This is not a vulnerability, this is expected behaviour.
http://www.openwall.com/lists/...
This paragraph suggests so many things which are simply wrong, confused,
or irrelevant that i don't know what to make of the rest of the article.
* modern debian GNU/Linux systems do not have a wheel group at all. No
particular versions or flavors of "Linux system"
* on systems where members of group wheel really do have unrestricted
access to the su command, having wheel in the first place *is* the
vulnerability -- it is a misconfiguration to expect an account to be
non-privileged if it is a member of wheel.
* the last sentence appears to be about setuid/setgid binaries, but
makes no mention that the overwhelming majority of binaries are not
setuid/setgid.
Later on, the post suggests that wheel group membership is related to
sudo privileges.
It also seems to assume that polkit always permits access for members of
group wheel. I can find no such configuration on a modern debian system.
I don't think there's anything significant in this ambiguous,
underspecified, and confused report.
http://www.openwall.com/lists/...
Yeah I looked into this (the article/etc was completely confusing and
took some time to parse):
1) the article states they contacted red hat, we were unable to find
any inbound email or bugzilla entry pertaining to this issue, as always
if you have an issue you wish to report please contact secalert@...hat.com
2) this is expected behaviour, admin users can install software (do I
have to say this? really? yes. I was told I should say this).
3) don't run web apps as admin users (do I have to say this? really?
yes. I was told I should say this).
4) if you feel the need to run a web app as an admin user restrict what
they can do via SELinux, and don't let them install software (do I have
to say this? really? yes. I was told I should say this).
So TL;DR: it's not a security vulnerability, and it will NOT be getting
a CVE.
I can only assume this article/vuln is perhaps referring to something
like Cpanel and other control panels that people sometimes install
insecurely/improperly and then never update. Or something. Who knows.
FUD article, it's not an exploit, well yes "admin user can mess up your computer especially if you configured repositories to allow installation of troyanned software from bad repository" well DUUUUUH.
... you can get root access.
Truth: some Linux distros have a "wheel" group.
Truth: this group is used as a list of people with elevated permissions
Truth: one of the elevated permissions often assigned to this group is the ability to become root, especially with sudo
Falsehood: all users on a Linux system are members of the "wheel" group
Falsehood: one can add oneself to the "wheel" group without having permissions already elevated above regular user status
tl;dr: someone misunderstands groups and called it a vulnerability
Do you guys do zero review or investigation before throwing up fear-mongering bullshit? If you haven't read TFA yet, don't even bother.
Debian derived distros disable the password on the root account by default, and only use the wheel group. RedHat distros set a root password during install, but also require the creation of a non-root user; this user is added to the wheel group. What Linux systems have you been using that are not RedHat or Debian derived?
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
being an Ubuntu user I don't have a wheel group, but this seems to be related to the fact that local users don't need root to install packages from the repositories. If there is a bad package in a trusted repository, then an untrusted local user could install it and the bad package could give that user root access. This is expected behaviour, I don't think you can install local packages through this rule (if you can then there is a vulnerability, create your own deb package with an install script that gives you root, then install it) but the point of trusted repositories is that you trust them, so you can install updates and new packages without admin access. The report seemed more concerned about talking about wheels and grinches than actually explaining the vulnerability.
Ubuntu does not have the wheel group: the initial user is added to the "sudo" group to give them access to sudo, but yea, most linux groups have used the wheel group ( though not at gid=0 ) since the '90s.
*Kits are intended for use on desktops, and not typically installed on servers, at least not in Ubuntu. Maybe redhat is silly here, I don't know. systemd is a non sequitur here.
And all the other *Kits - for making things fancy and GUI and creating a generation of Linux admins who don't actually know how things work.
I want to delete my account but Slashdot doesn't allow it.
to think that I remember when Wheel actually meant something! TOPS-20 forever! What a great OS, even if it had a lot of security holes.
Anybody knows why this group is called 'wheel' and not 'sudoers' or 'admins' or something along those lines? I mean if you have a novice home user and a random program asks for permission to be added to the 'wheel' group... "Wheel? What's that? Yeah, sure, whatever." 'Admins' at least might be cause for pause...
We hear all the time about Bullshit "security holes" like this. Complete with newly minted codenames ("grinch" in this case).
They also like to inflate benign things massively. Like the recent BASH exploit, which affected only strange folks who use bash scripting for internet-based services. M$ spun it as "everybody who has bash installed is affected", which is big fat BS, as probably 0.01% of Linux computers expose bash to strangers via an internet service.
Everybody else uses bash after having authenticated via ssh, so the "exploit" is not applicable. You cannot hack yourself, can you ?
Beware of the nastiness of the Sleazy Businessman !
Just switch to xBSD and take the remaining part of Linux with you. Or L4 from Uni Dresden.
Or, just use one of the forks which does not do Systemd. Actually YOU COULD DO THE FORK YOURSELF.
Everybody who can think rationally needs to consider that Linus Thorvalds one day turns into an NSA asset, if he hasnt done that a long time ago.
So, what gives ? Expect the worst and have contingency plans for that.
I know the Russkies have a bad rep in Pax Americana these days, BUT - maybe we need their ELBRUS CPU like Snwoden needed their asylum one day.
You know, when Jeb Bush has declared the War For The War Industry 5.0 and we find out they have pwned all x86 and ARM CPUs "so that we can pursue the WAR efficiently and put everybody under surveillance".
No news is good news.. there is news all over the place.
Krampus, obviously.
What's it like getting your ass kicked by apk + downmodding to hide it 20x http://tech.slashdot.org/comme... ?
What's it like getting your ass kicked by apk + downmodding to hide it 20x http://tech.slashdot.org/comme... ?
So their big scary bug is that, if you can somehow manage to insert yourself into the superuser group, you can gain superuser access to the machine? No shit Sherlocks.
If you are concerned about security, you will have a boot loader password configured, no changing the kernel command line. Of course, you would also have ensured no removable media are bootable, and have set a bios password, and have kept the server physically secured (no removing the BIOS battery, removing any disks etc.).
This is a very real vulnerability exploits a human's irrational fear of things they don't understand.
And they say Microsoft's stock grew 3 sizes that day.