bugtraq - Re: Todd Miller Sudo local root exploit discovered by Slouching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 03 Mar 2010 20:13:07 +0100
From: Jann Horn <jannhorn@...glemail.com>
To: bugtraq@...urityfocus.com
Subject: Re: Todd Miller Sudo local root exploit discovered by Slouching

Am Mittwoch, den 03.03.2010, 12:03 +0000 schrieb andy@...mail.com:
> Hi Kingcope,
> 
> ....but if the 'sudoers' file is correctly configured then you would not
> have the appropriate sudo permission to run the 'sudoedit' as root.
> 
> ....of course I'm assuming that the 'sudoers' file has not got the 'run
> any command' in it.
> 
> If the sudoers file used is even the default then I would think you would
> get some error on the lines of:
> 
> 'Sorry, user is not allowed to execute './sudoedit test' as root on this
> machine'.
> 
> Aren't you assuming the the sudoers file has a line in it that allows the
> user in question to run the /home/myhome/sudoedit as sudo???
> 
> Or am I missing something?
> 
> Andy

He's talking about a bug in sudo that allows him to run anything named
"sudoedit" if he can run commands that are in an alias named "sudoedit"
in /etc/sudoers.

Jann Horn