8 ms·
Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root
- RossM 14y agoCVE-2013-1775 [0] in case you're wondering. [0]: http://www.openwall.com/lists/oss-security/2013/02/27/22 http://www.openwall.com/lists/oss-security/2013/02/27/22 http://www.ubuntu.com/usn/usn-1754-1/ http://www.ubuntu.com/usn/usn-1754-1/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775
- raphinou 14y agoFrom the openwall link: > The vulnerability does not permit a user to run commands other than those allowed by the sudoers policy.
- grimtrigger 14y agoCan someone explain this a little more?
- shocks 14y agohttp://www.openwall.com/lists/oss-security/2013/02/27/22 http://www.openwall.com/lists/oss-security/2013/02/27/22 When a user successfully authenticates with sudo, a time stamp file is updated to allow that user to continue running sudo without requiring a password for a preset time period (five minutes by default). The user's time stamp file can be reset using "sudo -k" or removed altogether via "sudo -K". A user who has sudo access and is able to control the local clock (common in desktop environments) can run a command via sudo without authenticating as long as they have previously authenticated themselves at least once by running "sudo -k" and then setting the clock to the epoch (1970-01-01 01:00:00). The vulnerability does not permit a user to run commands other than those allowed by the sudoers policy.
- mpyne 14y agosudo -k resets the "needs a password to be entered" flag by changing the last-password-entered time to appear to be the UNIX epoch (time 0). If you then change the date to be the same day (which can be done without root permissions in modern Linux distros by using polkit or similar things), then you can use sudo to run commands as root without a password. Presumably, sudo checks the 'last-successful-login' entry alone before deciding whether to require a password. It ends up thinking you've previously successfully logged in even if you've never actually typed in the needed password.
- derekp7 14y agoSo there are two ways I can see to fix this. Either make setting the time always requires a password, or, add a signal that time-sensitive processes can listen to that gets tripped whenever time is altered.
- ScottBurson 14y agoThere's a much simpler fix that is local to sudo. Sudo has to make the decision of whether to require a password. Just change the line that says something like: if (current_time - last_password_time > INTERVAL) require_password(); to if (last_password_time == 0 || current_time - last_password_time > INTERVAL) require_password();
- bluesmoon 14y agowhen you run sudo, it might ask for a password. if you enter the right password, it sets a user timestamp saying "this was when you last entered your password", and for some (configured) amount of time after that, you can run sudo without requiring a password. sudo -k sets the timestamp to the epoch under the (misguided) assumption that the epoch will always be older than the configured time interval. some distributions allow any user to change the system time without requiring root privileges. These are typically user-friendly, single-user distributions, but many people run these same distributions on multi-user server boxes as well. so, if an attacker gains access to a user account, and assuming that user does have the right to sudo to root, the attacker can run these three commands to gain a root shell.
- JoachimSchipper 14y agoFrom http://www.openwall.com/lists/oss-security/2013/02/27/22 http://www.openwall.com/lists/oss-security/2013/02/27/22: By default, sudo displays a lecture when the user's time stamp file is not present. In sudo 1.6, the -k option was changed to reset the time stamp file to the epoch rather than remove it to prevent the lecture from being displayed the next time sudo was run. No special case was added for handling a time stamp file set to the epoch since the clock should never legitimately be set to that value.
- mpyne 14y agoInteresting! Does sudo somehow get confused about checking for a password at all when the current date is the UNIX epoch? I wonder, does this require the user to be listed in sudoers with any privileges or is it just straight to root?
- bluesmoon 14y agothe user does have to be listed in sudoers. there's no confusion with sudo, it's running as designed. It compares the current timestamp to the user timestamp to determine whether to ask for a password or not. The first flaw is in the date command allowing unprivileged users to set the time. The second is that the -K flag to sudo makes the -k flag obsolete, so the latter should be dropped.
- JoachimSchipper 14y agoThis gives you only the privileges that a successful "sudo" would give you, and requires a previous successful "sudo". It's a nice hack, but hardly the end of the world.
- brokentone 14y agoIt is, however, the beginning of the UNIX world
- mnarayan01 14y agoFrom the vulnerability announcement, it seems like this only allows a user to "set" NOPASSWD for that user's sudo regardless of what's in sudoers. It also doesn't seem to allow escalation beyond what's in sudoers. Am I missing something?
- nsmartt 14y agoIt sounds like you're overlooking the fact that software could do this without your knowledge.
- simias 14y agoSoftware that can do this could also just wait for you to run a sudo command and then install a rootkit before the timeout is reached. Or it could keylog your password. On desktop machines getting root is almost useless, you have all the sensitive information on the user account. Unless the attacker wants to install a rootkit in the kernel or open raw sockets or stuff like that. But if they can run arbitrary code with your UID you've probably already lost anyway.
- nsmartt 14y agoI suppose that's true, but ideally there should be no situation in which you give a program or script access to a terminal with sudo's timeout unreached. Compromising information not stored on the machine should ideally require root.
- mnarayan01 14y agoIt looks like you can run `sudo -k` without authenticating via password, so I guess you could use this to bypass the password requirement even if the user had not previously entered their password (provided that the account is capable of changing the system time). It's certainly worth mentioning (and patching), but I wouldn't describe it as "and boom you're root".
- dazzawazza 14y agoFrom the FreeBSD man for date Only the superuser may set the date, and if the system securelevel (see securelevel(7)) is greater than 1, the time may not be changed by more than 1 second. EDIT: so you need to be root anyway or have root access to change the date.
- nwh 14y agoUsers on MacOS can change the time without root access.
- simias 14y agoAre you sure? If it is it sounds like a possible security issue. Time is pretty sensitive as soon as certificates are involved. Many auth systems assume the clock is properly synchronized across the system. If that's true IMO that's the security issue, not the arguably strange behaviour of sudo in a situation that should never occur.
- dazzawazza 14y agowell from the terminal $ date 010101011970 date: bind: Permission denied date: settimeofday (timeval): Operation not permitted [15:45:41][dazza@imac.internal:~] From System Preferences you can indeed set the date back to 1970: $ date Fri 2 Jan 1970 00:56:44 BST [00:56:44][dazza@imac.internal:~] but there is a little lock that you might need to unlock (with a user password). This does seem like a security issue on OSX.
- adestefan 14y agoThat little lock icon is the same as running sudo from the command line. If the user is listed as an Administrator, then they're also able to sudo.
- pschastain 14y agoChanging back 01/01/1970 via Date & Time preferences doesn't need authentication, but the exploit still didn't work, at least for me.
- jrockway 14y agoTL;DR: users in /etc/sudoers can run code as root with sudo.
- killahpriest 14y agoIs 31 characters less worthy of a TL;DR?
- freehunter 14y agoI think that was a facetious remark, meaning "so in other words, if you have sudo access you can use sudo".
- hosay123 14y agoAn evil person with e.g. a stolen SSH key can escalate privileges on a machine without needing the user's password. It's not simply about sudo working as designed, it allows bypassing sudo's user authentication entirely. I can think of a handful of corporate machines (e.g. web servers) I've had pubkey access on where sudo allowed the real admin to gain root from the same account via sudo.
- __alexs 14y agoHow are they going to change the date without having a path to superuser access already?
- lukeschlather 14y agoThey could potentially spoof the machine's NTP server.
- DEinspanjer 14y agoThe NTP config on the machine would have to allow automatic changes without regard to the skew. I don't believe that is a default (or typically desired) configuration.
- p4bl0 14y agoPrevious discussion, with a better link than to a tweet: https://news.ycombinator.com/item?id=5299326 https://news.ycombinator.com/item?id=5299326
- StavrosK 14y agoIt doesn't work on Ubuntu, the clock gets reset back to 2010, for some reason.
- trotsky 14y agoI see your wonky authentication bypass and raise you a local privilege escalation that is 100% reliable on every distro that's shipped a 3.3-3.8 kernel (last 18 months or so) http://thread.gmane.org/gmane.linux.network/260061 http://thread.gmane.org/gmane.linux.network/260061 bad times :/
- bpeebles 14y agoLinux 3.3 came out 2012-03-18, that's just less than 12 months ago.
- allerratio 14y agoActually it is already fixed in many distros. For example in Arch Linux it took a day to fix since the CVE request: https://bugs.archlinux.org/task/34005 https://bugs.archlinux.org/task/34005 http://seclists.org/oss-sec/2013/q1/420 http://seclists.org/oss-sec/2013/q1/420 On the other hand my system here still crashes if I type file:/// with one big letter.
- subway 14y agoI wonder if it would be possible to walk back the date using an ntp mitm attack.
- _phred 14y agoVery, very difficult, unless the host relies on a single timesource. Best and common practice is to use 3-4 sources from different organizations in the ISC pool. It also wouldn't surprise me if most implementations of ntpd would have further safeguards about going 40 years back in time; at the very least the skew factor would make the clock change take a longgggg time to happen. There are much easier attack vectors.
- halviti 14y agoIt doesn't matter how many time sources there are. If you're doing an MITM attack, it's just as easy to fake multiple sources as it is to fake one.
- acdha 14y agoThis isn't always true: it all depends on where you [the attacker] are. If you've done something like compromise part of a large organization's network, it's entirely plausible that you could spoof either their internal NTP server or time.apple.com but not both.
- allerratio 14y agoActually I had to write a ntp spoofer for an university class. With arpspoof it is easy to manipulate all ntp traffic. At least ntpdate didn't complain when you sent it some years forward or backward.
- bathat 14y agontpdate won't complain because it's entire purpose is to set the time on a system that isn't synchronized with the rest of the world. So it is expected that the clock may have drifted by a substantial amount, and it is only meant to be used occasionally. It is especially bad practice to run it from cron. On the other hand, ntpd is a daemon that is meant to be run continuously. It will complain if lower-strata time servers start jumping around, and has a built-in mechanism for ignoring time servers that seem to be giving incorrect time (compared to both other servers and the system's own idea of the current time). Note that, if having accurate time is important, ntpd also supports using external reference clocks with a pulse-per second connected to, for example, a serial port.
- thoughtsimple 14y agoAfter using sudo from the command line, just remember to run sudo -K (note the capital-K) and you should be protected. The -K removes the timestamp which makes it impossible to reset it to 1/1/70 with -k.
- moe 14y agoIt may be worth noting that local privilege escalation vulnerabilities have always been dime a dozen, this is just a more egregious one. In your planning always keep in mind that anyone with shell-access to your server can become root in one way or another, if he really wants to. There is little "defense in depth" after that point.
- teknolust 14y agoTried it on Debian Mint and it doesn't work. I can't set my clock without sudo.
- lurker14 14y agoWhy does "sudo -k" still exist, when it has obvious risks and is superseded by "sudo -K". Why does 'sudo -k' not check to see if a timestamp exists, and avoid creating one if it doesn't yet exist?
- hukl 14y agoIt works if you set your time through system preferences in OSX, Gnome and KDE on some distros. Changing it on those desktop guis does not require admin password. Also see: http://www.sudo.ws/sudo/alerts/epoch_ticket.html http://www.sudo.ws/sudo/alerts/epoch_ticket.html
- hukl 14y agoAlso be sure to set the date including timezone offset. On OSX run sudo -k, open date and time prefs. Set date to 1970-01-01 00:00:00 including timezone offset (+1 for CET) then run sudo su
- rplacd 14y agoI'm surprised an issue that high-level's been able to lurk around for so long.
- ohazi 14y agoDebian unstable got a fix for this last night: http://packages.debian.org/changelogs/pool/main/s/sudo/sudo_1.8.5p2-1+nmu1/changelog http://packages.debian.org/changelogs/pool/main/s/sudo/sudo_...
- Nux 14y ago"Set your clock to 01.01.1970" BOOM, you can't! "date: cannot set date: Operation not permitted"