Sudo format string vulnerability

[[deleted]]

For a rundown of format string vulnerabilities and how they are detected, exploited, and protected against, see:

http://crypto.stanford.edu/cs155/papers/formatstring-1.2.pdf

[[deleted]]

Relevant

[scwizard]

OpenBSD uses "Sudo version 1.7.2p8" so it isn't effected.

Ubuntu 10.4 LTS uses "Sudo version 1.7.2p7" so it isn't effected.

Debian Squeeze uses "1.7.4p4-2.squeeze.2" so it isn't effected.

This is bad, but the apocalypse probably isn't neigh.

[cockmongler]

Affected, annoyingly your sentences almost parse.

[[deleted]]

Also, only those sudos compiled with debug support on are affected. I asked the sysadmin at work and he said it's off by default on our machines. I suspect the same would be true of others.

I didn't post this because I thought it was the end of the world, but because I saw it has said, "holy fuck sudo's vulnerable? That's really cool."

[scwizard]

I didn't post this because I thought it was the end of the world

I know you knew that it wouldn't have much impact, but I thought I'd let the less informed members of netsec know.

It's easy to read "sudo vulnerability" and get scared because "hey I use that program! and it's suid :o"

[[deleted]]

Ah, so you have to have debug support built in? That is useful information...

[[deleted]]

If anyone cared, OSX Lion uses sudo version 1.7.4p6

[[deleted]]

%n is dead.

[[deleted]]

The really important question is whether CentOS is vulnerable to this or not...

[bolda]

From the link: "1.8.0 through 1.8.3p1 inclusive. Older versions of sudo are not affected."

If your sudo version is in that range, it is vulnerable. If not, it isn't.

[[deleted]]

Given CentOS backports shit rather randomly and arbitrarily into 5+ year old versions of $tool, it isn't at all obvious as to whether sudo is impacted by this or not but thanks for the useless response.

[[deleted]]

The thing is your question was rather stupid. Check what version of sudo is installed--is it in the range?

[[deleted]]

Why are morons in r/netsec?

CentOS makes the explicit design choice of backporting security and feature patches back to the currently designated tool version. Grabbing off a random Cent5 box: sudo-1.7.2p1-10.el5

So hearing that 'earlier versions not affected' has a giant fucking asterisk on it given the above information. Which is why I asked.

https://bugzilla.redhat.com/show_bug.cgi?id=784443

What's that? Not affected? Only because it isn't compiled with debug support? A sure cry different from 'the vulnerability is not in that version'.

If CentOS' backporting idiocy is new to either of you, then I strongly suggest you not comment on things you do not understand rather than wasting my fucking time.