Stories
Slash Boxes
Comments

SoylentNews is people

Ten-Year Old sudo Vulnerability Gives Root Privileges on Host

posted by Fnord666 on Thursday January 28 2021, @07:31AM   Printer-friendly
from the hiding-in-plain-site dept.

upstart writes in with an IRC submission for Bytram:

Ten-Year Old Sudo Vulnerability Gives Root Privileges on Host:

A major security hole in the Sudo utility could be abused by unprivileged users to gain root privileges on the vulnerable host, Qualys reports.

Designed to allow users to run programs with the security privileges of another user (by default superuser, hence the name, which is derived from 'superuser do'), Sudo is present in major Unix- and Linux-based operating systems out there.

Tracked as CVE-2021-3156, the recently identified vulnerability, which Qualys refers to as "Baron Samedit," was introduced in July 2011, and can be exploited to gain root privileges using a default Sudo configuration.

This means that an attacker able to compromise a low-privileged account on the machine could abuse the vulnerability to gain root access.

All legacy versions of Sudo, from 1.8.2 to 1.8.31p2, as well as the utility's stable releases from 1.9.0 to 1.9.5p1 are affected, in their default configuration.

[...] Qualys, which provides an in-depth technical analysis of the vulnerability, has published a proof-of-concept video to demonstrate how the issue can be exploited.

Also at Bleeping Computer.

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

CVE-2021-3156

Original Submission

 
This discussion has been archived. No new comments can be posted.
Ten-Year Old sudo Vulnerability Gives Root Privileges on Host | Log In/Create an Account | Top | 42 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Insightful) by Grishnakh on Thursday January 28 2021, @05:43PM (1 child)

    by Grishnakh (2831) on Thursday January 28 2021, @05:43PM (#1106175)

    When you use a language like Go or Rust you are simply offloading this responsibility to someone else (the developers of that language).

    Yes, and that's a good thing. The people writing compilers are generally much better programmers than the average programmers using those languages, and when the language devs fix a bug, suddenly that whole class of problem or vulnerability is eliminated for *all* programs compiled with that compiler, instead of countless average programmers having to go check their code manually.

    Starting Score:    1  point
    Moderation   +3  
       Insightful=3, Total=3
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   5  

  • (Score: 2, Insightful) by Anonymous Coward on Friday January 29 2021, @01:46AM

    by Anonymous Coward on Friday January 29 2021, @01:46AM (#1106418)

    https://gcc.gnu.org/bugzilla/ [gnu.org]
    Look here prior to fantasizing.

    Note that some bugs in there stay unfixed for a decade or more.

    Also note that people who modify sudo of all things, are *supposed* to be even more qualified, and more careful, than those who hack at compilers. Observe the fat lot of good it has done.

    The ONLY way for such vulnerabilities not to crop up, is for people to STOP MONKEYING WITH THINGS THAT WORK and STOP PILING UP COMPLEXITY FOR THE SAKE OF IT.
    Behold the commit that caused all this:
    https://github.com/sudo-project/sudo/commit/8255ed69 [github.com]
    " Go back to escaping the command args for "sudo -i" and "sudo -s"
    before calling the plugin. Otherwise, spaces in the command args
    are not treated properly. The sudoers plugin will unescape non-spaces
    to make matching easier."
    Plugins. In sudo. Need anything more be said?