Attack scenario if files in /bin/ or /sbin/ owned by normal user but not invoked by sudo?

Question

I've learnt the following symlink is insecure because sometime i use vim to edit file by sudo:

xiaobai@dnxb:/tmp$ sudo find -L /root \! -user root 
/root/.vimrc
xiaobai@dnxb:/tmp$ ls -lathi /root/.vimrc
25 lrwxrwxrwx 1 root root 20 Oct  3 23:22 /root/.vimrc -> /home/xiaobai/.vimrc
xiaobai@dnxb:/tmp$ ls -lathiL /root/.vimrc
12330229 -rw-r--r-- 1 xiaobai xiaobai 6.1K Oct 12 02:22 /root/.vimrc
xiaobai@dnxb:/tmp$ 

But how about this file:

[xiaobai@localhost tmp]$ sudo find -L /bin \! -user root
/bin/sp-sc-auth
[xiaobai@localhost tmp]$ ls -lahi /bin/sp-sc-auth
1844640 lrwxrwxrwx. 1 root root 49 Aug 14 21:10 /bin/sp-sc-auth -> /home/xiaobai/note/src/sopcast/sp-auth/sp-sc-auth
[xiaobai@localhost tmp]$ ls -lahiL /bin/sp-sc-auth
6164581 -rwxrwxr-x. 1 xiaobai xiaobai 839K Aug 14 21:09 /bin/sp-sc-auth
[xiaobai@localhost tmp]$

I run sopcast-player without sudo/su, so should i worry about it ? Is it possible attacker take advantage of this kind of file which owned by normal user located in system $PATH but not executed directly by sudo/su ? And how about if gid is same group of normal user ?

Answer 1

Any program or script that is run by a user, whether that user is root or an ordinary account, will run with the privileges associated with the account running the program.

When you have root running a program, the program can do everything that root can do.

If you have a program owned by an ordinary user that is executed by root, that user therefore implicitly has root access because the program can do anything that the user has programmed.