OSVDB ID: 4893 Title: FreeBSD k5su Group Check Failure |
Info |
|
|
Dates |
||||
|
|
Description |
The k5su utility contains a flaw that may allow a local user to gain access to unauthorized privileges. The issue is triggered when a local user who does not have 'wheel' group membership executes k5su and enters the root password. This flaw results in complete control of the host by the attacker. |
Classification |
Location:
Local Access Required
Attack Type: Authentication Management Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to disable k5su by removing the suid bit. The suid for k5su is removed by default in subsequent releases as well as in the STABLE branch after 2002-05-15. |
Products |
|
References |
|
Credit |
|
hotmail.com -