Sudo Axes Escalation Glitch

Among the important benefits of Linux's permission hierarchy is its ability to keep untrusted users from running amok. The all-or-nothing nature of root access, however, can present headaches when users are trusted, but only so far. That is a problem the sudo utility attempts to solve, and does so fairly well — except for the occasional glitch.

A glitch of this sort turned up last week, allowing less-privileged users to skirt around sudo's protections and gain the powers of other users, including the superpowers of root. A vulnerability in sudo's sudoedit pseudo-command (sudo -e) could allow arbitrary command execution by those empowered to use the command. (Users can be granted access to specific abilities like sudoedit, without being assigned full sudo access.) According to sudo's security advisory:

When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file (currently, the only pseudo-command is sudoedit). Unlike a regular command, pseudo-commands do not begin with a slash ('/'). The flaw is that sudo's the matching code would only check against the list of pseudo-commands if the user-specified command also contained no slashes. As a result, if the user ran "sudo ./sudoedit" the normal matching code path was followed, which uses stat(2) to verify that the user-specified command matches the one in sudoers. In this case, it would compare the "./sudoedit" specified by the user with "sudoedit" from the sudoers file, resulting in a positive match.

The advisory notes that impact of the vulnerability is mitigated by the utility's defaults, however. Exploiting the glitch depends on sudoedit having been enabled in /etc/sudoers — the pseudo-command is not configured by default, rendering most installs impervious to the attack. All versions of sudo from 1.6.9 to 1.7.2p3, the then-stable release, are affected — versions 1.7.2p4 (now superseded by 1.7.2p5) and 1.6.9p21 patch the vulnerability. Mandriva, Red Hat, and Ubuntu have already pushed updated versions out to users.

Interestingly enough, sudo — the creation of SUNY/Buffalo students Cliff Spencer and Bob Coggshall — celebrates its thirtieth anniversary this year. Though it is often associated with sudo-dependent distributions like Ubuntu, which disables the root account entirely, it first appeared in 1980, some eleven years before Linux development began. The utility has been consistently rewritten over its three decades, to the extent that none of its original code remains. More information about sudo and its development can be found on the sudo project website.


Justin Ryan is a Contributing Editor for Linux Journal.


Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

No sudo for me, thanks!

Vasilis Plessas's picture

I personally avoid the use of sudo all together in my distro - Archlinux that is.

Call me old school but I much rather prefer to do give a "su -" command as a regular user, fix what it needs to get fixed and get the hell out by doing "su - myusername" or just typing "exit"

It feels simpler and cleaner this way especially in a multiuser enviroment.

101 Tech Tips DVD

spjrb-pdx's picture

I recently purchased it and am having a problem finding the tip shown in the lower left. It would be great if there was a searchable index by subject that when clicked on would take you to the tip. Otherwise good stuff.

Why is there a picture of

Anonymous's picture

Why is there a picture of Kyle Rankin displayed so prominently in an article by Justin Ryan? It's especially strange to see that the picture matches this week's member giveaway. 3-4-10

It's the T-Shirt

Mitch Frazier's picture

That's a "root superhero" t-shirt: sudo ~= root.

Mitch Frazier is an Associate Editor for Linux Journal.

I can't believe I didn't get that

Anonymous's picture

I'm sad to say that went right over my head. Kudos to you, and I apologize if I insulted your integrity or the integrity of LinuxJournal as a whole and thank you very much for the explanation. Double kudos if you intended "~=" to mean approximately equal to!

No Apologies Necessary

Mitch Frazier's picture

It was far from obvious, no apology necessary. And yes "~=" was intended as approximately equal.

Mitch Frazier is an Associate Editor for Linux Journal.

default is secure - good news

thogarty's picture

I'm glad to hear the default config is secure.

It's good to see the community being open about flaws and fixing them quickly. Another reason to prefer Linux and/or open source! :)