3 ms·

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version av

• comfydragon 6y ago
  That version has the patches for this CVE. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 I had basically the same comment on the first HN posts about it. Just because `sudo -V` doesn't say 1.9.5p2 doesn't mean you're still vulnerable... https://news.ycombinator.com/item?id=25920839 https://news.ycombinator.com/item?id=25920839
  • deleted 6y ago
    [deleted]
• deleted 6y ago
  [deleted]
• deleted 6y ago
  [deleted]
• nickjj 6y ago
  Did you run sudo apt-get update first? I'm running WSL 2 here with Ubuntu 20.04 LTS and this is what worked for me, without having to install anything from source. Without doing anything (vulnerable): nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'` malloc(): corrupted top size Aborted Then I ran this to patch it: sudo apt-get update && sudo apt-get --only-upgrade install sudo And now this is the output (I guess not vulnerable anymore): nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'` usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ... After patching it `dpkg -l | grep sudo` reports 1.8.31-1ubuntu1.2. I didn't think to run that before patching it but I'd guess it's going to be different.