Researchers uncover a 10-year old vulnerability in Linux

Feb. 9, 2021, 12:46 p.m.

TL;DR

Security researchers at Qualys, the cloud security firm, have uncovered a 10-year old vulnerability in Sudo, a utility included in almost all Linux and Unix-based operating systems. The vulnerability allows any unprivileged user to gain access to root privileges on a vulnerable host using a default Sudo configuration.

The vulnerability may enable a malicious user to execute custom code on the host with root privileges

Key Facts

1
Sudo is a utility that allows users to run programs with the security privileges of another user. The vulnerability in Sudo was first introduced in July 2011 and affected all versions from 1.8.2 to 1.8.31p2, and the default configuration of all stable versions from 1.9.0 to 1.9.5p1.
2
Qualys security researchers were able to identify the vulnerability and develop various ways to exploit it to gain full root privileges on Ubuntu 20.04, Debian 10, and Fedora 33. Likely, other operating systems can also be exploited.
3
A bug in the Sudo code, related to the sudoedit command, allows you to avoid the escape characters and overflow the heap-based buffer through a command-line argument that ends with a single backslash character.
4
According to Qualys, Sudo v1.9.5p2, a new version of Sudo, has been created to patch the problem.
5
Two Sudo security flaws CVE-2019-14287 and CVE-2019-18634, have been discovered in the past two years. However, the vulnerability disclosed recently is considered the most damaging.

Details

As per the Qualys report, the buffer overflow vulnerability allows the attacker to control the size of the buffer and control the contents of the overflow itself. The vulnerability may enable a malicious user to execute custom code on the host with root privileges. It is also possible for the attacker to write null bytes to the overflowed buffer.

According to Qualys, to test if a system is vulnerable or not, you may log in to the system as a non-root user. Then run the command “sudoedit -s /”. If the system responds with an error that starts with “sudoedit:”, your system is vulnerable. If it has been patched, it will respond with an error that starts with “usage:”

A new version of Sudo - Sudo v1.9.5p2 - has been created to patch the problem. Notifications for the same have been posted for many Linux distros, including Fedora, Debian, Ubuntu, Gentoo, and SUSE, according to Qualys.

The Qualys Research Team has discovered a critical vulnerability in #Sudo, which allows an unprivileged user to gain root privileges in its default configuration. #linux #unix #vulnerability https://t.co/JUAo8ULMu7
— Qualys (@qualys) January 26, 2021