Sudo Axes Escalation Glitch
Among the important benefits of Linux's permission hierarchy is its ability to keep untrusted users from running amok. The all-or-nothing nature of root access, however, can present headaches when users are trusted, but only so far. That is a problem the sudo utility attempts to solve, and does so fairly well — except for the occasional glitch.
A glitch of this sort turned up last week, allowing less-privileged users to skirt around sudo's protections and gain the powers of other users, including the superpowers of root. A vulnerability in sudo's sudoedit pseudo-command (sudo -e) could allow arbitrary command execution by those empowered to use the command. (Users can be granted access to specific abilities like sudoedit, without being assigned full sudo access.) According to sudo's security advisory:
When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file (currently, the only pseudo-command is sudoedit). Unlike a regular command, pseudo-commands do not begin with a slash ('/'). The flaw is that sudo's the matching code would only check against the list of pseudo-commands if the user-specified command also contained no slashes. As a result, if the user ran "sudo ./sudoedit" the normal matching code path was followed, which uses stat(2) to verify that the user-specified command matches the one in sudoers. In this case, it would compare the "./sudoedit" specified by the user with "sudoedit" from the sudoers file, resulting in a positive match.
The advisory notes that impact of the vulnerability is mitigated by the utility's defaults, however. Exploiting the glitch depends on sudoedit having been enabled in /etc/sudoers — the pseudo-command is not configured by default, rendering most installs impervious to the attack. All versions of sudo from 1.6.9 to 1.7.2p3, the then-stable release, are affected — versions 1.7.2p4 (now superseded by 1.7.2p5) and 1.6.9p21 patch the vulnerability. Mandriva, Red Hat, and Ubuntu have already pushed updated versions out to users.
Interestingly enough, sudo — the creation of SUNY/Buffalo students Cliff Spencer and Bob Coggshall — celebrates its thirtieth anniversary this year. Though it is often associated with sudo-dependent distributions like Ubuntu, which disables the root account entirely, it first appeared in 1980, some eleven years before Linux development began. The utility has been consistently rewritten over its three decades, to the extent that none of its original code remains. More information about sudo and its development can be found on the sudo project website.
Justin Ryan is a Contributing Editor for Linux Journal.
|Non-Linux FOSS: libnotify, OS X Style||Jun 18, 2013|
|Containers—Not Virtual Machines—Are the Future Cloud||Jun 17, 2013|
|Lock-Free Multi-Producer Multi-Consumer Queue on Ring Buffer||Jun 12, 2013|
|Weechat, Irssi's Little Brother||Jun 11, 2013|
|One Tail Just Isn't Enough||Jun 07, 2013|
|Introduction to MapReduce with Hadoop on Linux||Jun 05, 2013|
- Containers—Not Virtual Machines—Are the Future Cloud
- Non-Linux FOSS: libnotify, OS X Style
- Lock-Free Multi-Producer Multi-Consumer Queue on Ring Buffer
- Linux Systems Administrator
- Validate an E-Mail Address with PHP, the Right Way
- Introduction to MapReduce with Hadoop on Linux
- RSS Feeds
- Weechat, Irssi's Little Brother
- New Products
- Tech Tip: Really Simple HTTP Server with Python
- Poul-Henning Kamp: welcome to
2 hours 3 min ago
- This has already been done
2 hours 4 min ago
- Reply to comment | Linux Journal
2 hours 49 min ago
- Welcome to 1998
3 hours 37 min ago
- notifier shortcomings
4 hours 1 min ago
5 hours 38 min ago
- Android User
5 hours 40 min ago
- Reply to comment | Linux Journal
7 hours 33 min ago
10 hours 22 min ago
- This is a good post. This
15 hours 35 min ago
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?