Sudo Flaw Lets Linux Users Run Commands As Root Even When They're Restricted

guest · Oct 14, 2019

Sudo Flaw Lets Linux Users Run Commands As Root Even When They're Restricted
October 14, 2019
https://thehackernews.com/2019/10/linux-sudo-run-as-root-flaw.html

A vulnerability has been discovered in Sudo—one of the most important, powerful, and commonly used utilities that comes as a core command installed on almost every UNIX and Linux-based operating system.

The vulnerability in question is a sudo security policy bypass issue that could allow a malicious user or a program to execute arbitrary commands as root on a targeted Linux system even when the "sudoers configuration" explicitly disallows the root access.

"This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification," the Sudo developers say.
How to Exploit this Bug? Just Sudo User ID -1 or 4294967295
The vulnerability, tracked as CVE-2019-14287 and discovered by Joe Vennix of Apple Information Security, is more concerning because the sudo utility has been designed to let users use their own login password to execute commands as a different user without requiring their password.
What's more interesting is that this flaw can be exploited by an attacker to run commands as root just by specifying the user ID "-1" or "4294967295."
Click to expand...

Sudo: Potential bypass of Runas user restrictions

sukarof · Oct 14, 2019

Kubuntu patched it yesterday.

mirimir · Oct 15, 2019

Huh, I'm almost sure that I've seen this before. Quite some time ago. Months, at least.

But whatever. Debian doesn't install sudo by default. And as I recall, never has.

summerheat · Oct 15, 2019

sukarof said: ↑

Kubuntu patched it yesterday.
Click to expand...

So did Arch Linux, of course

summerheat · Oct 15, 2019

Here's an article from The Register that sorts things out:

This security vulnerability, assigned CVE-2019-14287, is more interesting than scary: it requires a system to have a non-standard configuration. In other words, Linux computers are not vulnerable by default.
Click to expand...

guest · Feb 2, 2020

Buffer Overflow In Older Sudo Versions Could Be Used To Get Root On Elementary, Linux Mint
February 2, 2020
https://linuxreviews.org/Buffer_Ove...Be_Used_To_Get_Root_On_Elementary,_Linux_Mint

Malicious users could potentially use a buffer overflow in specific older sudo versions to gain root access if sudo is configured to provide visual feedback when passwords are entered. This is not the default on most GNU/Linux distributions and it is not the default upstream.
Some distributions, such as Elementary and Linux Mint, do enable the optional pwfeedback feature to provide users with visual feedback when a password is entered. You may want to check if you are using an affected sudo version and make sure pwfeedback is disabled if you are.

Sudo versions 1.7.1 to 1.8.25p1 are vulnerable to a buffer overflow if the non-default pwfeedback option is enabled in /etc/sudoers.
Some distributions, like Ubuntu and Linux Mint, do enable it in order to provide fancy *** feedback when a password is entered. Distributions who enable pwfeedback may be vulnerable to a buffer overflow vulnerability known as CVE-2019-18634.

Sudo versions 1.8.26 through 1.8.30 are not affected due to a totally unrelated change in EOF handling introduced in sudo 1.8.26. Current sudo versions are not affected.
Click to expand...

Don't Panic
You can run sudo -V ; sudo -l to see what sudo version you have and what options and rights are enabled.
Most distributions will have a newer version of sudo. The last affected version, 1.8.25p1, was released in August 2018.

Elementary and Linux Mint do enable the pwfeedback option so you will want to either upgrade sudo to a safe version or set Defaults !pwfeedback in /etc/sudoers if you are using one of those distributions.
Click to expand...

reasonablePrivacy · Feb 2, 2020

Yet again flaw in sudo? No wonder OpenBSD written and replaced it with doas command.

chrisretusn · Feb 2, 2020

I don't view this as a serious flaw, while pwfeedback is a default setting in some Linux distributions, it is not the default for upstream or in Slackware. That and for Slackware64-cuurent at least, has been on 1.8.27 since Jan 2019. Slackware is now on 1.8.31.

mirimir · Feb 3, 2020

Debian doesn't use sudo, by default. Just su.

Compu KTed · Feb 3, 2020

Have sudo version 1.8.21p2
Says user may run the following commands on xxxxx...
(ALL : ALL) ALL
(root) NOPASSWD: /usr/lib/linuxmint/mintUpdate/checkAPT.py

guest · Feb 9, 2020

Ubuntu-based elementary OS 5.1.2 Hera update fixes dangerous Linux sudo bug
February 9, 2020
https://betanews.com/2020/02/09/elementary-os-sudo-linux/

A few days ago, we reported on an extremely serious sudo bug that impacted some Unix and Linux-based operating systems. While Ubuntu was not affected, two popular operating systems based on it -- Linux Mint and elementary OS -- were impacted, sadly. This was due to pwfeedback being enabled on those operating systems.

Thankfully, the folks over at elementary have already squashed the bug in the latest version -- 5.1.2 Hera.
Those already running elementary OS 5.x can simply upgrade through the AppCenter to get the sudo fix.
Click to expand...

Log in or Sign up

Sudo Flaw Lets Linux Users Run Commands As Root Even When They're Restricted

guest Guest

sukarof Registered Member

mirimir Registered Member

summerheat Registered Member

summerheat Registered Member

guest Guest

reasonablePrivacy Registered Member

chrisretusn Registered Member

mirimir Registered Member

Compu KTed Registered Member

guest Guest

Log in or Sign up

Sudo Flaw Lets Linux Users Run Commands As Root Even When They're Restricted

guest Guest

sukarof Registered Member

mirimir Registered Member

summerheat Registered Member

summerheat Registered Member

guest Guest

reasonablePrivacy Registered Member

chrisretusn Registered Member

mirimir Registered Member

Compu KTed Registered Member

guest Guest

Useful Searches