bugtraq - Re: Sudo: local root compromise with krb5 enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 7 Jun 2007 13:55:52 -0600
From: "Mark Senior" <senatorfrog@...il.com>
To: "James Downs" <egon@...n.cc>
Cc: "Thor Lancelot Simon" <tls@....tjls.com>,
	bugtraq@...urityfocus.com
Subject: Re: Sudo: local root compromise with krb5 enabled

On 6/7/07, James Downs wrote:
>
> On Jun 6, 2007, at 6:57 PM, Thor Lancelot Simon wrote:
>
> > The 'sudo' package can be built to use Kerberos 5 for authentication
> > of users.  When a user is properly authenticated to sudo, sudo grants
>
> It should be noted that Kerberos is not an authorization system.  All
> this case does is allow a user, who can already log into your system,
> and already can use sudo, to bypass their real password.  If the user
> can't do things as root, correct or incorrect password isn't buying
> them much.
>
> This IS a bug in handling kerberos authentication, but if the user
> can log into the system, the user can use any version of sudo, and if
> they're authorized, they already know their password, and can do
> things as root.

In Suse Linux 10, the default /etc/sudoers has

...
Defaults targetpw    # ask for the password of the target user i.e. root
ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!
...

In other words, in the SuSE default config, sudo is just an
overcomplicated su - to sudo something as root, you need not your own
password, but root's - except you don't have to be in wheel to use it.

If sudo is configured as above, and uses kerberos, then all users
might be able to exploit this.