Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heap-based buffer overflow in Sudo

qualys.com

Post reply on HN
Print view View original

11–20 of 328 posts

Re: Heap-based buffer overflow in Sudo

#11

Post by sigio »

2bitencryption wrote: post #9

I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always as…

Nope... sudo is just this sudo in 99.99% of the cases. There are some alternatives, such as *bsd's doas, and others, but all but doas and su are so non-popular and outdated that I would not recommend using them, as they probably have way more security issues.

Re: Heap-based buffer overflow in Sudo

#13

Post by wahern »

sigio wrote: post #11
2bitencryption wrote: post #9

I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always as…

Nope... sudo is just this sudo in 99.99% of the cases. There are some alternatives, such as *bsd's doas, and others, but all but doas and su are so non-popular and outdated that I would not recommend using them, as they probably have way more security issues.

doas is just OpenBSD. You can install doas from ports on NetBSD or FreeBSD, just like you can install doas on Linux.

OpenBSD dropped sudo from the base OS several years ago. sudo just became too complex, tailored to the feature creep demanded and required (PAM, ugh) by Linux users.

Re: Heap-based buffer overflow in Sudo

#14

Post by bawolff »

2bitencryption wrote: post #9

I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always as…

Wikipedia has a history section https://en.wikipedia.org/wiki/Sudo#History

But every tool has to be maintained by someone. Its not like GNU is a faceless corporation.

Re: Heap-based buffer overflow in Sudo

#17

Post by eqvinox »

pjmlp wrote: post #12
nahuel0x wrote: post #6

"rewrite sudo in Rust" in 3,2...

Why? After all it is obvious code reviewers are enough to catch any typical C memory corruption error.

People use the tools they have available and understand. Rust, at the time this bug was introduced into sudo, was barely a year old, and hadn't even released 0.1 yet.

Also, the sarcasm in your comment really doesn't help your message.

Re: Heap-based buffer overflow in Sudo

#18

Post by acct776 »

sigio wrote: post #11
2bitencryption wrote: post #9

I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always as…

Nope... sudo is just this sudo in 99.99% of the cases. There are some alternatives, such as *bsd's doas, and others, but all but doas and su are so non-popular and outdated that I would not recommend using them, as they probably have way more security issues.

doas has a much smaller attack surface, and is worth checking out.
Post reply on HN