PoC Exploit for Nginx packaging on Debian-based distros [video]

well I guess for a webserver gaining any privileges is already bad. of course privilege escalation is bad, especially on client machine's, but on servers? well if you are an attacker from the outside and already have a shell your security is done anyway.

of course as said that won't apply to shared hosting (with shell) and client machines.

Re: PoC Exploit for Nginx packaging on Debian-based distros [video]

#5

Post by eikenberry » Wed, Nov 16, 2016, 9:42 PM UTC

I just looked at my current Debian Jessie system and it is not as described. That is /var/log/nginx is not owned by www-data, it is owned by root. It was freshly installed not to long ago and was only configured with my ansible setup. So I'm pretty sure that was the default.

Re: PoC Exploit for Nginx packaging on Debian-based distros [video]

#6

Post by rlpb » Wed, Nov 16, 2016, 10:56 PM UTC

This was fixed in Ubuntu in October: https://www.ubuntu.com/usn/usn-3114-1/

Re: PoC Exploit for Nginx packaging on Debian-based distros [video]

#7

Post by w8rbt » Thu, Nov 17, 2016, 12:11 AM UTC

An LSM such as SELinux, Tomoyo or AppArmor could mitigate this.

Re: PoC Exploit for Nginx packaging on Debian-based distros [video]

#8

Post by eikenberry » Thu, Nov 17, 2016, 1:38 AM UTC

eikenberry wrote: post #5

I just looked at my current Debian Jessie system and it is not as described. That is /var/log/nginx is not owned by www-data, it is owned by root. It was freshly installed not to long ago and was only configured with my ansible setup. So I'm pretty sure that was the default.

I think I know why... it was fixed a few weeks ago.

https://www.debian.org/security/2016/dsa-3701

Re: PoC Exploit for Nginx packaging on Debian-based distros [video]

#9

Post by eikenberry » Thu, Nov 17, 2016, 1:42 AM UTC

w8rbt wrote: post #7

An LSM such as SELinux, Tomoyo or AppArmor could mitigate this.

I was just researching these a little while ago and hadn't heard of Tomoyo. Turns out it is included in the mainline kernel and is pretty simple to use.

http://tomoyo.osdn.jp/

On debian you just need to enable it via a kernel param and install tomoyo-tools to get going.

Re: PoC Exploit for Nginx packaging on Debian-based distros [video]

#10

Post by w8rbt » Thu, Nov 17, 2016, 6:23 PM UTC

eikenberry wrote: post #9

w8rbt wrote: post #7

An LSM such as SELinux, Tomoyo or AppArmor could mitigate this.

I was just researching these a little while ago and hadn't heard of Tomoyo. Turns out it is included in the mainline kernel and is pretty simple to use. http://tomoyo.osdn.jp/ On debian you just need to enable it via a kernel param and install tomoyo-tools to get going.

I like Tomoyo better than any of the others. I find it the easiest to configure and reason about.