Polkit Lessons

This was already discussed here. I'd be worried if FreeBSD devs need to watch this video to get the Qualys report.
It's already fixed. It was not possible to pull the exploit on FreeBSD though, not even via Linux ABI.

What is more troublesome is that the issue itself was reported almost 10 years ago. And after the Qualys report I've seen some other reports where this kind of argv handling took place. But those programs were not setuid so fuzz was not so high.
 
_martin said:
This was already discussed here. I'd be worried if FreeBSD devs need to watch this video to get the Qualys report.
It's already fixed. It was not possible to pull the exploit on FreeBSD though, not even via Linux ABI.

What is more troublesome is that the issue itself was reported almost 10 years ago. And after the Qualys report I've seen some other reports where this kind of argv handling took place. But those programs were not setuid so fuzz was not so high.
Click to expand...
Awesome that FBSD is insulated.
Also agree that an issue this long in the tooth and harboring such reach has not been actively addressed globally.
Thnx for the heads up _martin- it matters to me!
 
You must log in or register to reply here.
Back
Top