Sudoedit can edit arbitrary files
41–50 of 61 posts
Re: Sudoedit can edit arbitrary files
#42I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?
Doubtful, failing to sanitize your inputs plagues memory safe languages too.
It's kind of tiring to hear about memory safe languages (mainly rust here) being put on a pedestal, as if it will solve all our software woes.
Not to mention, C++ /can/ be memory safe if you use memory-safe routines.
I'm just waiting for articles to come in, this year.. "why 2023 was not the year of Rust". Not hating on Rust - just the evangelism.
Re: Sudoedit can edit arbitrary files
#43[deleted]
Re: Sudoedit can edit arbitrary files
#44I find it handy that most distros have a CVE look-up 'service': * https://security-tracker.debian.org/tracker/CVE-2023-22809 * https://ubuntu.com/security/CVE-2023-22809 * https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-22809 Debian has links to the others.
https://security.archlinux.org/
[dead]
Re: Sudoedit can edit arbitrary files
#45I find it handy that most distros have a CVE look-up 'service': * https://security-tracker.debian.org/tracker/CVE-2023-22809 * https://ubuntu.com/security/CVE-2023-22809 * https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-22809 Debian has links to the others.
I would opt for the Red Hat CVE Database over Bugzilla if you aren't using Fedora, but they all interlink:
https://access.redhat.com/security/cve/CVE-2023-22809
Red Hat has quite a few services under the /security path.
Re: Sudoedit can edit arbitrary files
#46Consider this a prompt to review your /etc/sudoers for any utility whose behaviour is modified by environment variables in the env_keep list.
I don't think that's what's happening. sudoedit does NOT run the editor as root, it copies the file to a temporary as root, runs the editor as you, and copies the temporary over the target file as root when you're done editing it (at least it's supposed to).
Looks like a misclick, but unsure which comment was intended for this reply.
Re: Sudoedit can edit arbitrary files
#47I find it handy that most distros have a CVE look-up 'service': * https://security-tracker.debian.org/tracker/CVE-2023-22809 * https://ubuntu.com/security/CVE-2023-22809 * https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-22809 Debian has links to the others.
Re: Sudoedit can edit arbitrary files
#48Is there a patch, or more detailed explanation of what causes this?
It shells out to the EDITOR environment variable, which is controlled by the less privileged user. In this example they inject running an editor against another file. I'm guessing you can put arbitrary code in there or point it at a locally controlled executable too. But I'm not sure. Maybe sudoedit puts more scrutiny on that variable than most, non-security programs. At any rate many text editors have lots of module…
> At any rate many text editors have lots of modules and scripting and can presumably load and execute code as the privileged user.
Sudoedit does not run the editor as privileged user, that is kinda the whole point
Re: Sudoedit can edit arbitrary files
#49Earlier quoted context omitted.
Looking at the patch[1], probably not. There isn't really a lot of complex string handling involved; it's basically just forgetting to forbid "--". I don't really see how any language choice could help you with this. [1]: https://github.com/sudo-project/sudo/commit/0274a4f3b403162a...
goto statement in something as important as sudo? Seriously? Talk about bad practices.
I think if you read the kennel's code you're in to a big surprise.
Re: Sudoedit can edit arbitrary files
#50Why would one prefer to add sudoedit X to sudoers rather than updating file access privileges of X directly? Just curious about arguments for this use case.
[deleted]