bugtraq - Re: sudoedit local privilege escalation through PATH manipulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 22 Apr 2010 10:04:09 +0200
From: Agazzini Maurizio <inode@...iaservice.net>
To: bugtraq@...urityfocus.com
Cc: bugtraq@...netcobalt.net
Subject: Re: sudoedit local privilege escalation through PATH manipulation

On 20/04/2010 8.42, Ansgar Wiechers wrote:
> Perhaps I'm missing something, but how is this a security flaw? A user
> who is allowed to run "sudoedit" can edit /etc/sudoers, and thus allow
> himself to run any command anyway.
> 
> Regards
> Ansgar Wiechers

In the configuration file (sudoers) you can specify the file that the
user is allowed to edit (http://www.gratisoft.us/sudo/man/sudoers.html).
The bug allow you to bypass these controls and gain root privileges.

Best regards,

Maurizio

-- 
Maurizio Agazzini                     CISSP, OPST
Senior Security Advisor
Team Manager
@ Mediaservice.net Srl                Tel: +39-011-32.72.100
Via San Bernardino, 17                Fax: +39-011-32.46.497
10141 Torino - ITALY                  http://mediaservice.net/