full-disclosure - Re: Advisory: sudo 1.8 Format String Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201201311614.q0VGE0oZ008769@core.courtesan.com>
Date: Tue, 31 Jan 2012 11:14:00 -0500
From: "Todd C. Miller" <Todd.Miller@...rtesan.com>
To: Agostino Sarubbo <ago@...too.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Advisory: sudo 1.8 Format String Vulnerability

On Mon, 30 Jan 2012 20:38:25 +0100, Agostino Sarubbo wrote:

> The first says:
> adding -D_FORTIFY_SOURCE=2 to the OSDEFS line in src/Makfile and rebuilding 
> sudo will prevent the bug from being exploited.
> 
> The second says:
> he above example shows the result of FORTIFY_SOURCE which makes explotitation
>  
> painful but not impossible (see [0]). Without FORTIFY_SOURCE the exploit is 
> straight forward.
> 
> something should be corrected?

joernchen is correct, it is probably still possible to exploit with
-D_FORTIFY_SOURCE=2, though it is more difficult.  On systems with
ASLR and a non-executable stack it should be even harder.

I've updated http://www.sudo.ws/sudo/alerts/sudo_debug.html to
reflect this.

 - todd

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/