5 ms·
CVE-2021-3156: Sudo privilege escalation
- bunnyfoofoo 6y agoTo test if you're vulnerable: sudoedit -s '\' `perl -e 'print "A" x 65536'` Per: https://www.sudo.ws/alerts/unescape_overflow.html https://www.sudo.ws/alerts/unescape_overflow.html Write-up: https://seclists.org/fulldisclosure/2021/Jan/79 https://seclists.org/fulldisclosure/2021/Jan/79
- jimrandomh 6y agoOof, I'm surprised sudo has lasted this long without serious inspection and fuzzing that should've caught this. Given its sensitive nature and low complexity, I'd say this utility is a high priority for being rewritten in rust.
- MaxLeiter 6y agoIf you tell rust to do silly things it will still do silly things. The “fix” for this is less complexity, like doas. Sudo is a ridiculously complex program
- csnover 6y agoDiscussed previously: https://news.ycombinator.com/item?id=25919494 https://news.ycombinator.com/item?id=25919494 https://news.ycombinator.com/item?id=25919360 https://news.ycombinator.com/item?id=25919360 https://news.ycombinator.com/item?id=25919235 https://news.ycombinator.com/item?id=25919235