This is quite a common way to bypass sudo (get access to a user who already logged in as sudo and reset clock), I remember seeing the same exploit (or variations) time and time again, for multiple systems.
[deleted]
Mac OS X Sudo Password Bypass
31–40 of 53 posts
Re: Mac OS X Sudo Password Bypass
#32Why not add: sudo -K to .bash_logout
1. Because that doesn't fix the vulnerability, only narrows the window in which the exploit works.
2. Because it breaks the "ttl" feature of sudo for people who log in and out frequently (e.g., create and destroy terminal windows).
3. Because .bash_logout is only executed when a login shell exits.
Perhaps a similar but more elaborate solution could work to better mitigate this, though.
Re: Mac OS X Sudo Password Bypass
#33I'm very surprised that the 'sudo' timeout feature wasn't implemented against the system's RTC using something like CLOCK_MONOTONIC. Or put differently, the idea that you'd use absolute time to implement a requirement that's defined in terms of relative time seems a bit absurd. Anyone have any clues as to why this wasn't implemented that way? For reference, CLOCK_MONOTONIC is defined in time.h and is part of the POSI…
CLOCK_MONOTONIC is not available on OS X. Also, isn't CLOCK_MONOTONIC_RAW fetching the counter from rdtsc instruction on x86? (And therefore can go backwards in time if your process is migrated to another CPU).
Keep in mind, also, that the CLOCK_MONOTONIC is not part of the core POSIX standard, so OS X is technically "compliant" even though they didn't implement it. Add this to a list of annoyances, such as no pthread_cond_timed_wait().
You can, however, get a monotonic clock by getting access to the clock service on mach.
Re: Mac OS X Sudo Password Bypass
#34Why not add: sudo -K to .bash_logout
1. Because that doesn't fix the vulnerability, only narrows the window in which the exploit works. 2. Because it breaks the "ttl" feature of sudo for people who log in and out frequently (e.g., create and destroy terminal windows). 3. Because .bash_logout is only executed when a login shell exits. Perhaps a similar but more elaborate solution could work to better mitigate this, though.
This is probably good enough for most purposes if the user is somewhat informed.
Always use a new shell for sudo. Always exit that shell when done.
Re: Mac OS X Sudo Password Bypass
#35Earlier quoted context omitted.
Yes. And nope, I'm not referring to 'sudo brew install'. The main homebrew page says, 'run this ruby script'. The ruby script is available at: https://raw.github.com/mxcl/homebrew/go The script includes a sudo command. To be fair, I hadn't read the script in detail when I wrote my post, just far enough to see there was a definition of a sudo function. On review, it looks like they either call it to chmod/chgrp HOMEBR…
Fair enough. I think everyone agrees that the "download and execute a random gist" method of installation is not great.
I don't see any reason why it's worse than running a binary installer, and people seem to object to that a lot less for some reason.
Re: Mac OS X Sudo Password Bypass
#36Here's a workaround until Apple updates sudo, add the following to you /etc/sudoers file:
Defaults timestamp_timeout=0Re: Mac OS X Sudo Password Bypass
#37How much sense would it make to annotate a variable as being representative of a "present time" and then have the compiler insert a check that the variable must be greater than the time at which the file was compiled (plus or minus some fuzz to account for daylight savings and time zones)?
Re: Mac OS X Sudo Password Bypass
#38How much sense would it make to annotate a variable as being representative of a "present time" and then have the compiler insert a check that the variable must be greater than the time at which the file was compiled (plus or minus some fuzz to account for daylight savings and time zones)?
It would be a bandaid that could be circumvented by the same exploit using not 1970-01-01 but the date of latest OS/binary update release - that date would be >= compilation date, and <= today, so would work.
Re: Mac OS X Sudo Password Bypass
#39sudo offers updated binaries for OS X 10.5 and up so you don't have to wait for Apple: http://www.sudo.ws/sudo/download.html#binary
If you don't trust the binaries, I found it easy to update the vulnerable sudo v1.7.0 on my OS X 10.6 machine by building from source and overwriting the one supplied by Apple:
0) Backup /usr/bin/sudo (temporarily; you'll want to delete the old sudo after verifying the new one works), and backup /etc/sudoers just to be safe
1) Download the source for sudo v1.7.10p7 linked on sudo's homepage: http://www.sudo.ws
2) Untar, ungzip, go to resulting source directory
3) Run configure, telling it to overwrite the vulnerable sudo
configure --prefix=/usr/bin
make
sudo make install
See also the sudo installation notes here: http://www.sudo.ws/sudo/install.html
Re: Mac OS X Sudo Password Bypass
#40No security that needs time should be based on an insecure clock. Is there any kind of network "verified time" facility using PKC?