Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

When a user successfully authenticates with sudo, a time stamp file is updated to allow that user to continue running sudo without requiring a password for a preset time period (five minutes by default). The user's time stamp file can be reset using "sudo -k" or removed altogether via "sudo -K".

A user who has sudo access and is able to control the local clock (common in desktop environments) can run a command via sudo without authenticating as long as they have previously authenticated themselves at least once by running "sudo -k" and then setting the clock to the epoch (1970-01-01 01:00:00).

The vulnerability does not permit a user to run commands other than those allowed by the sudoers policy.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#6

Post by mpyne » Fri, Mar 01, 2013, 2:47 PM UTC

grimtrigger wrote: post #3

Can someone explain this a little more?

sudo -k resets the "needs a password to be entered" flag by changing the last-password-entered time to appear to be the UNIX epoch (time 0).

If you then change the date to be the same day (which can be done without root permissions in modern Linux distros by using polkit or similar things), then you can use sudo to run commands as root without a password.

Presumably, sudo checks the 'last-successful-login' entry alone before deciding whether to require a password. It ends up thinking you've previously successfully logged in even if you've never actually typed in the needed password.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#7

Post by bluesmoon » Fri, Mar 01, 2013, 2:48 PM UTC

grimtrigger wrote: post #3

Can someone explain this a little more?

when you run sudo, it might ask for a password. if you enter the right password, it sets a user timestamp saying "this was when you last entered your password", and for some (configured) amount of time after that, you can run sudo without requiring a password.

sudo -k sets the timestamp to the epoch under the (misguided) assumption that the epoch will always be older than the configured time interval.

some distributions allow any user to change the system time without requiring root privileges. These are typically user-friendly, single-user distributions, but many people run these same distributions on multi-user server boxes as well.

so, if an attacker gains access to a user account, and assuming that user does have the right to sudo to root, the attacker can run these three commands to gain a root shell.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#8

Post by JoachimSchipper » Fri, Mar 01, 2013, 2:50 PM UTC

grimtrigger wrote: post #3

Can someone explain this a little more?

From http://www.openwall.com/lists/oss-security/2013/02/27/22:

    By default, sudo displays a lecture when the user's time stamp
    file is not present.  In sudo 1.6, the -k option was changed
    to reset the time stamp file to the epoch rather than remove
    it to prevent the lecture from being displayed the next time
    sudo was run.  No special case was added for handling a time
    stamp file set to the epoch since the clock should never
    legitimately be set to that value.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#9

Post by bluesmoon » Fri, Mar 01, 2013, 2:50 PM UTC

mpyne wrote: post #4

Interesting! Does sudo somehow get confused about checking for a password at all when the current date is the UNIX epoch? I wonder, does this require the user to be listed in sudoers with any privileges or is it just straight to root?

the user does have to be listed in sudoers.

there's no confusion with sudo, it's running as designed. It compares the current timestamp to the user timestamp to determine whether to ask for a password or not. The first flaw is in the date command allowing unprivileged users to set the time. The second is that the -K flag to sudo makes the -k flag obsolete, so the latter should be dropped.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#10

Post by raphinou » Fri, Mar 01, 2013, 2:50 PM UTC

RossM wrote: post #2

CVE-2013-1775 [0] in case you're wondering. [0]: http://www.openwall.com/lists/oss-security/2013/02/27/22 http://www.ubuntu.com/usn/usn-1754-1/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775

From the openwall link: > The vulnerability does not permit a user to run commands other than those allowed by the sudoers policy.