5 ms·

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package ma

by raimue 6y ago

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

shrx 6y ago
Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.
- comfydragon 6y ago
  That version has the patches for this CVE. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 I had basically the same comment on the first HN posts about it. Just because `sudo -V` doesn't say 1.9.5p2 doesn't mean you're still vulnerable... https://news.ycombinator.com/item?id=25920839 https://news.ycombinator.com/item?id=25920839
  - deleted 6y ago
    [deleted]
- deleted 6y ago
  [deleted]
- deleted 6y ago
  [deleted]
- nickjj 6y ago
  Did you run sudo apt-get update first? I'm running WSL 2 here with Ubuntu 20.04 LTS and this is what worked for me, without having to install anything from source. Without doing anything (vulnerable): nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'` malloc(): corrupted top size Aborted Then I ran this to patch it: sudo apt-get update && sudo apt-get --only-upgrade install sudo And now this is the output (I guess not vulnerable anymore): nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'` usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ... After patching it `dpkg -l | grep sudo` reports 1.8.31-1ubuntu1.2. I didn't think to run that before patching it but I'd guess it's going to be different.
shawnz 6y ago
Right, the correct solution here for WSL would also be to run "apt-get upgrade" or whatever your distro uses.
- mcrump 6y ago
  I noticed that I had a typo in my command. -- original comment You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s
  - shawnz 6y ago
    I think you accidentally typoed the first command "apt-get update" as "apt-get upgrade", which is why it didn't work there.
    - mcrump 6y ago
      Correct! Thank you!
    - JosephRedfern 6y ago
      Good spot! AFAIK Ubuntu under WSL(2) uses the same update repository as a non-WSL variants, so you shouldn't get different results.

by raimue 6y ago

shrx 6y ago

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.

comfydragon 6y ago
That version has the patches for this CVE. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 I had basically the same comment on the first HN posts about it. Just because `sudo -V` doesn't say 1.9.5p2 doesn't mean you're still vulnerable... https://news.ycombinator.com/item?id=25920839 https://news.ycombinator.com/item?id=25920839
- deleted 6y ago
  [deleted]
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
nickjj 6y ago
Did you run sudo apt-get update first? I'm running WSL 2 here with Ubuntu 20.04 LTS and this is what worked for me, without having to install anything from source. Without doing anything (vulnerable): nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'` malloc(): corrupted top size Aborted Then I ran this to patch it: sudo apt-get update && sudo apt-get --only-upgrade install sudo And now this is the output (I guess not vulnerable anymore): nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'` usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ... After patching it `dpkg -l | grep sudo` reports 1.8.31-1ubuntu1.2. I didn't think to run that before patching it but I'd guess it's going to be different.

shawnz 6y ago

Right, the correct solution here for WSL would also be to run "apt-get upgrade" or whatever your distro uses.

mcrump 6y ago
I noticed that I had a typo in my command. -- original comment You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s
- shawnz 6y ago
  I think you accidentally typoed the first command "apt-get update" as "apt-get upgrade", which is why it didn't work there.
  - mcrump 6y ago
    Correct! Thank you!
  - JosephRedfern 6y ago
    Good spot! AFAIK Ubuntu under WSL(2) uses the same update repository as a non-WSL variants, so you shouldn't get different results.