Any list somewhere which provides a list of affected OSs or at least how to check?
sudo --version
anything below version 1.9.5p2 is affected
Heap-based buffer overflow in Sudo
21–30 of 328 posts
Re: Heap-based buffer overflow in Sudo
#22In case no one gets the pun: https://en.wikipedia.org/wiki/Baron_Samedi
Re: Heap-based buffer overflow in Sudo
#23I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always as…
> Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another
It is true that BSD and linux sometimes have different implementations of posix commands.
The vast majority of linux distros are using the same gnu coreutils though. There are alternate implementations (like busybox, among others), but they're not often used in desktop distros.
I'm curious if you have any example of a linux distro that does treat ls so weirdly; that uses anything other gnu coreutils or busybox for it.
Re: Heap-based buffer overflow in Sudo
#24Any list somewhere which provides a list of affected OSs or at least how to check?
sudo --version anything below version 1.9.5p2 is affected
Unless the patches have been backported, as is the case for Ubuntu 18.04, in which case it may not need to be 1.9.5p2. https://launchpad.net/ubuntu/+source/sudo/1.8.21p2-3ubuntu1....
Re: Heap-based buffer overflow in Sudo
#25Earlier quoted context omitted.
Why? After all it is obvious code reviewers are enough to catch any typical C memory corruption error.
People use the tools they have available and understand. Rust, at the time this bug was introduced into sudo, was barely a year old, and hadn't even released 0.1 yet. Also, the sarcasm in your comment really doesn't help your message.
I have been advocating against C since comp.lang.c days, no need for lessons about how to market something that the audience obviously isn't interested into paying attention.
The first systems programming language that would prevented this kind of exploit was written in 1961, 10 years before C was invented.
Re: Heap-based buffer overflow in Sudo
#26Never knew sudo had a site ( https://sudo.ws ). Never knew it had a mascot, if you could call it so... I will never unsee it. Nightmare fuel at it's finest.
Every time you run it, it is eating a part of your soul. Nom nom nom
Re: Heap-based buffer overflow in Sudo
#27In case no one gets the pun: https://en.wikipedia.org/wiki/Baron_Samedi
Good memories playing with Voodoo mode on x86.
Re: Heap-based buffer overflow in Sudo
#28I don't find bug reports for this in either Debian or Ubuntu bug tracking systems. When do these get entered?
Re: Heap-based buffer overflow in Sudo
#29Earlier quoted context omitted.
People use the tools they have available and understand. Rust, at the time this bug was introduced into sudo, was barely a year old, and hadn't even released 0.1 yet. Also, the sarcasm in your comment really doesn't help your message.
I have been advocating against C since comp.lang.c days, no need for lessons about how to market something that the audience obviously isn't interested into paying attention. The first systems programming language that would prevented this kind of exploit was written in 1961, 10 years before C was invented.
Neither of these is an excuse for the condescending, snarky tone.
[Ed.: Actually, the tone is probably a factor in the audience not being interested.]