dash: privilege escalation [LWN.net]

Package(s):

dash

CVE #(s):

CVE-2009-0854

Created:

March 10, 2009

Updated:

March 11, 2009

Description:

From the Ubuntu advisory: Wolfgang M. Reimer discovered that dash, when invoked as a login shell, would source .profile files from the current directory. Local users may be able to bypass security restrictions and gain root privileges by placing specially crafted .profile files where they might get sourced by other dash users.

Alerts:

Ubuntu

USN-732-1

2009-03-10

(Log in to post comments)