SoylentNews is people
SoylentNews
Ten-Year Old Sudo Vulnerability Gives Root Privileges on Host:
A major security hole in the Sudo utility could be abused by unprivileged users to gain root privileges on the vulnerable host, Qualys reports.
Designed to allow users to run programs with the security privileges of another user (by default superuser, hence the name, which is derived from 'superuser do'), Sudo is present in major Unix- and Linux-based operating systems out there.
Tracked as CVE-2021-3156, the recently identified vulnerability, which Qualys refers to as "Baron Samedit," was introduced in July 2011, and can be exploited to gain root privileges using a default Sudo configuration.
This means that an attacker able to compromise a low-privileged account on the machine could abuse the vulnerability to gain root access.
All legacy versions of Sudo, from 1.8.2 to 1.8.31p2, as well as the utility's stable releases from 1.9.0 to 1.9.5p1 are affected, in their default configuration.
[...] Qualys, which provides an in-depth technical analysis of the vulnerability, has published a proof-of-concept video to demonstrate how the issue can be exploited.
Also at Bleeping Computer.
CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)
(Score: 2) by hendrikboom on Friday January 29 2021, @08:57PM
There are alternatives to Rust.
Consider Scheme. Specifically, the Gambit [umontreal.ca] implementation [umontreal.ca] of Scheme.
Its compiler generates C code from Scheme source, and explicitly permits you to specify what C code is to be generated for any new functions you define in your program should you wish to.
Compatible with C? Yes. You can even use it as a scripting language for existing C code if you desire. And it can be efficiently compiled all the way to machine code if you have a C compiler on hand.
(and it can also generate C++ if you need that)
Now I grant that this is a completely different kind of language from Rust, and is not likely to appeal to a lot of Rust programmers.
But it's clear that the space of potential C-compatible safe programming languages is vast and has hardly been explored.