12 year old bug; root

[version2013]

Interesting article:
https://www.bleepingcomputer.com/news/s ... -released/
https://arstechnica.com/information-tec ... ux-distro/

[jamesbond]

Thanks @version2013 (I'm still not used to calling you version2013, I still remember you as @greendome ).

Fatdog64 in all of its versions are not affected because we don't use polkit

[ozsouth]

For those of us with standard puppies, the first article contains a temporary mitigation - run in a terminal:
chmod 0755 /usr/bin/pkexec
Removes the setuid bit, so non-root programs cannot escalate to root priviliges.
Anything needing to do that will fail. Use at own risk.

[wiak]

https://threatpost.com/linux-bug-in-all ... ue/177996/

If there’s one saving grace in this Log4j-esque, déjà vu situation, it’s that PwnKit is a local privilege-escalation vulnerability. “Any vulnerability that gives root access on a Linux system is bad. Fortunately, this vulnerability is a local exploit, which mitigates some risk,” Yaniv Bar-Dayan, CEO and co-founder at Vulcan Cyber, told Threatpost on Wednesday.

I suspect doesn't matter on Puppy since running as root user locally anyway. A local exploit by root user to become root user ... ???