Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

USBCreator D-Bus Privilege Escalation in Ubuntu Desktop

Summary: A vulnerability in Ubuntu's USBCreator D-Bus interface let any user in the sudo group overwrite arbitrary files as root without a password, because the com.ubuntu.USBCreator Image method passed user-controlled source and target paths to a Python implementation of dd with no path sanitation and no password prompt. Ubuntu patched the relevant packages on June 18 and now requires password authentication to launch USBCreator; Unit 42, which disclosed the issue, said it was not aware of active exploitation.

Key Takeaway: The bar to exploit this was membership in the sudo group, not root - and the payoff was overwriting the shadow file to set a root password, which turns a routine developer account into full system compromise.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related