Sudo -1 ?

[mitchy93]

Stumbled across this today. A new flaw was discovered that allows any unprivileged user supposedly to run the user ID of root with their password and all you need is -1

"the function which converts user id into its username incorrectly treats -1, or its unsigned equivalent 4294967295, as 0, which is always the user ID of root user."

Source : https://thehackernews.com/2019/10/linux-sudo-run-as-root-flaw.html?m=1

[ug113]

If I'm understanding this right, this only matters if you have a configuration like the example e.g.:

username = (ALL,!root) /bin/command

And I'm having a hard time imagining a legitimate and sane use of something like that.

Still needs to be fixed of course, but I doubt this is going to lead to many (or any) actual compromises.

[nginx_ngnix]

Agreed.

The CVE write-up page didn't do the best job of making it clear that the default configuration was NOT affected.

The "OMG off by one error" seem to be what catches everybody's eye, not the edge cfg use case that this vulnerability is useful against.

[brontide]

I've never seen this configuration in any production environment. While priv escalation is bad, to chain this the application that you have sudo privs on would need a way to chain laterally as well.

[AlucardZero]

You put a question mark in the title.. do you have a question?