11–20 of 43 posts
I was initially confused if this was just WSL as "WSL and Linux" could be interpreted that way. It's not just WSL. It would appear to be sudo, wherever it runs. I didn't see anything Linux specific about the CVE, other than maybe there are platforms that are better about heap-based buffer overflows.
Earlier quoted context omitted.
Right, the correct solution here for WSL would also be to run "apt-get upgrade" or whatever your distro uses.
I noticed that I had a typo in my command. -- original comment You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s
I was initially confused if this was just WSL as "WSL and Linux" could be interpreted that way. It's not just WSL. It would appear to be sudo, wherever it runs. I didn't see anything Linux specific about the CVE, other than maybe there are platforms that are better about heap-based buffer overflows.
It is sudo. It affects Linux, WSL, etc.
Earlier quoted context omitted.
I noticed that I had a typo in my command. -- original comment You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s
I think you accidentally typoed the first command "apt-get update" as "apt-get upgrade", which is why it didn't work there.
Earlier quoted context omitted.
Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.
That version has the patches for this CVE. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 I had basically the same comment on the first HN posts about it. Just because `sudo -V` doesn't say 1.9.5p2 doesn't mean you're still vulnerable... https://news.ycombinator.com/item?id=25920839
Also for the `sudoedit -s /` check what does it mean if you get a "sorry, user X is not allowed to execute BLAH BLAH"?
Discussed here https://news.ycombinator.com/item?id=25962057