Apple Patches 10-Year-Old macOS SUDO Root Privilege Escalation Bug

Apple has rolled out a fix for a critical sudo vulnerability in macOS Big Sur, Catalina, and Mojave that could allow unauthenticated local users to gain root-level privileges on the system. "A local attacker may be able to elevate their privileges," Apple said in a security advisory. "This issue...

Security fix for the ALT Linux 8 package sudo version 1:1.9.5p2-alt0.M80P.1

1:1.9.5p2-alt0.M80P.1 built Feb. 6, 2021 Evgeny Sinelnikov in task 265379 Jan. 27, 2021 Evgeny Sinelnikov - Backport latest security release fixed CVE-2021-3156 to p8/c8/c8.1 branches without sudo python plugin due it not compatible with python3.5...

Exploit for Off-by-one Error in Sudo_Project Sudo

PoC exploit for CVE-2021-3156, a vulnerability in the Linux kern...

Sudo 1.8.25p - pwfeedback Buffer Overflow (PoC)

Sudo 1.8.25p - pwfeedback Buffer Overflow PoC Title: Sudo 1.8.25p - Buffer Overflow Date: 2020-01-30 Author: Joe Vennix Software: Sudo Versions: Sudo versions prior to 1.8.26 CVE: CVE-2019-18634 Reference: https://www.sudo.ws/alerts/pwfeedback.html Sudo's pwfeedback option can be used to provide...

PT-2019-4664 · Todd Miller +4 · Sudo +4

Name of the Vulnerable Software and Affected Versions: Sudo versions 1.8.29 and earlier Description: The issue is related to the sudoer account with Runas ALL privileges, allowing an attacker to impersonate a nonexistent user by invoking sudo with a numeric uid not associated with any user. This...

UBUNTU-CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...

sudo 1.8.28 Security Bypass

Exploit Title : sudo 1.8.28 - Security Bypass Date : 2019-10-15 Original Author: Joe Vennix Exploit Author : Mohin Paramasivam Version : Sudo priv" os.syste...

CVE-2017-1000368

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution...

DEBIAN-CVE-2017-1000367

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation embedded spaces in the getprocessttyname function resulting in information disclosure and command execution...

sudo 1.8.0 < 1.8.3p1 - 'sudo_debug' glibc FORTIFY_SOURCE Bypass + Privilege Escalation

/ death-star.c sudo v1.8.0-1.8.3p1 sudodebug format string root exploit + glibc FORTIFYSOURCE bypass by aeon - http://infosecabsurdity.wordpress.com/ This PoC exploits: - CVE-2012-0864 - FORTIFYSOURCE format string protection bypass via "nargs" integer overflow - CVE-2012-0809 - sudo v1.8.0-1.8.3...

CVE-2013-2776

sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the ttytickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another...

sudo -- local privilege escalation

Todd Miller reports: Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo's -g option run as group, if allowed by the sudoers file. A flaw exists in sudo's password checking logic that allows a user to run a command with only...

DEBIAN-CVE-2010-0427

sudo 1.6.x before 1.6.9p21, when the runasdefault option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command...

Sudo &lt;= 1.6.9p18 (Defaults setenv) Local Privilege Escalation Exploit

No description provided by source. !/bin/sh Sudo = 1.6.9p18 local r00t exploit by Kingcope/2008/www.com-winner.com Most lame exploit EVER! Needs a special configuration in the sudoers file: --- "Defaults setenv" so environ vars are preserved : --- May also need the current users password to be...

Sudo 1.6.9p18 - Defaults SetEnv Local Privilege Escalation

Sudo 1.6.9p18 - Defaults SetEnv Local Privilege Escalation !/bin/sh Sudo "Defaults setenv" so environ vars are preserved : program.c include include include void init if !geteuid unsetenv"LDPRELOAD"; setgid0; setuid0; execl"/bin/sh","sh","-c","chown 0:0 /tmp/xxxx; /bin/chmod +xs /tmp/xxxx",NULL;...

Sudo &lt;= 1.6.8p9 (SHELLOPTS/PS4 ENV variables) Local Root Exploit

No description provided by source. Sudo local root escalation privilege vuln versions : sudo 1.6.8p10 by breno You need sudo access execution for some bash script Use csh shell to change SHELLOPTS env ie: %cat x.sh !/bin/bash -x echo "Getting root!!" % cat /etc/sudoers ... breno ALL=ALL...

Security fix for the ALT Linux 8 package sudo version 1:1.6.7p5-alt5

June 21, 2005 Dmitry V. Levin 1:1.6.7p5-alt5 - Backported upstream fix so a sudoers entry with sudo ALL no longer overwrites the value of safecmnd CAN-2005-1993...

PT-2005-2798 · Todd Miller · Sudo

Name of the Vulnerable Software and Affected Versions: Sudo version 1.6.8p7 Description: The issue allows local users to potentially gain privileges by using sudo to call su, then entering a blank password and hitting CTRL-C. However, it has been noted that Sudo catches SIGINT and returns an empt...

Sudoedit can expose file contents

Sudoedit can expose file contents Summary: A flaw in exists in sudo's -u option aka sudoedit in sudo version 1.6.8 that can give an attacker read permission to a file that would otherwise be unreadable. Sudo versions affected: 1.6.8 only Details: While sudoedit runs the actual editor as the...

Sudo version 1.6.3p6 now available

Sudo version 1.6.3p6 is now available ftp sites listed at the end. This fixes a buffer overflow in sudo which is a potential security problem. I don't know of any exploits that currently exist but I suggest that you upgrade none the less. Sudo has a good track record wrt secure coding, but this o...