[Wolves] Adobe AIR behaves as though it's SUID, WTF?

Alex Willmer alex at moreati.org.uk
Fri Dec 19 01:10:11 UTC 2008


Either I've gone insane, or Adobe has.

Platform: Ubuntu 8.10

Steps to reproduce:
     1. BBC has released iPlayer desktop for Linux. Do a yay!
     2. It uses Adobe AIR, oh well. Place Freedom Hater hat on head.
     3. Download Flash 10.0.15.3 <http://get.adobe.com/flashplayer/>
     4. Download AIR 1.5 <http://get.adobe.com/air/>, 
     5. Make it executable, run from console, sign over first born. 
     6. Supply password to gksudo access when asked.
     7. Once installed, log out then in, to flush gksudo password cache.
     8. Download an AIR app, eg
        <http://desktop.ebay.com/release/eBayDesktop_1_0_6_361.air>
     9. Double click the downloaded file, sign over second born.
    10. Wait for install to complete. Note lack of password request
    11. Check what's in /opt/ is there a directory for the eBay app?

I swear AIR is managing to write stuff to /opt/, without asking for my
password to perform a sudo.

Anyone able to offer rebuttals, confirmations or suggestions?

Notes:
      * AIR appears to put stuff in ~/.adobe and ~/.appdata
      * The AIR installer dynamically creates adobe-certs and adobeair
        in the dpkg database. Removing these appears to uninstall AIR.

Alex




More information about the Wolves mailing list