oss-security - CVE request: local privilege escalation flaw in Red Star OS 3.0

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAO33bZX7RP0fZOns1Rn-AE7Da8Hxmo3YP5MAa1TMmO2AUM1Vrg@mail.gmail.com>
Date: Thu, 8 Jan 2015 20:10:18 -0800
From: David Jorm <david.jorm@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: local privilege escalation flaw in Red Star OS 3.0

Hi All

Red Star OS 3.0 (붉은별) ships with the root account disabled. A flaw has been
identified that allows a local user to jailbreak the environment and gain
root access. As noted here:
http://richardg867.wordpress.com/2015/01/01/notes-on-red-star-os-3-0/

"The root user is disabled on Red Star, and it doesn’t look like there is a
way to enable it. Fortunately, they left a big security hole: the Software
Manager (swmng.app), which runs as root through sudo and will install any
RPM package, even if unsigned."

Please assign a CVE ID to this issue.

Thanks

David

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.