sudo privilege escalation (CVE-2021-3156/Baron Samedit)

https://www.bleepingcomputer.com/news/s...

Posodobite sudo na svojih Linux sistemih.

The Sudo privilege escalation vulnerability tracked as CVE-2021-3156 (aka Baron Samedit) was discovered by security researchers from Qualys, who disclosed it on January 13th and made sure that patches are available before going public with their findings.

According to Qualys researchers, the issue is a heap-based buffer overflow exploitable by any local user (normal users and system users, listed in the sudoers file or not), with attackers not being required to know the user's password to successfully exploit the flaw.

The buffer overflow allowing any local user to obtain root privileges is triggered by Sudo incorrectly unescaping backslashes in the arguments.

"Normally, sudo escapes special characters when running a command via a shell (sudo -s or sudo -i)," the 1.9.5p2 changelog reads.

"However, it was also possible to run sudoedit with the -s or -i flags in which case no escaping had actually been done, making a buffer overflow possible."

Qualys created three CVE-2021-3156 exploits to showcase how this vulnerability can be successfully abused by potential attackers.

Using these exploits, the researchers were able to obtain full root privileges on multiple Linux distributions, including Debian 10 (Sudo 1.8.27), Ubuntu 20.04 (Sudo 1.8.31), and Fedora 33 (Sudo 1.9.2).

Other operating systems and distributions supported by Sudo are probably also exploitable using CVE-2021-3156 exploits according to Qualys.

Further technical details on how CVE-2021-3156 can be exploited are available in Qualys' CVE-2021-3156 security advisory published on Tuesday.

To test if your system is vulnerable, you have to login as a non-root user and run the "sudoedit -s /" command. Vulnerable systems will throw an error starting with "sudoedit:" while patched ones will display an error starting with "usage:" .

System admins who use Sudo to delegate root privileges to their users should immediately upgrade to sudo 1.9.5p2 or later as soon as possible.

Na pravilno setuppanem sistemu moraš najprej bit v pravi skupini, da sploh imaš dostop do sudo ukaza.

Poznas katero distribucijo Linuxa, ki ima "pravilno setuppan" sistem ze privzeto?

Jap, to je to: https://www.debian.org/security/2021/ds...

Saj obstaja dovolj tem na internetu, kako se pravilno nastavi UNIX po inštalaciji...

Je tam nekje 25-40 korakov, pač odvisno koliko kompliciraš...

Ja, je, ampak to je za uporabnike... načeloma to niso strežniki.

Tale lista je precej dobra... Uporabiš, kar misliš, da je pametno...

https://www.cyberciti.biz/tips/linux-se...

Je tam nekje 25-40 korakov, pač odvisno koliko kompliciraš...

In kateri izmed teh korakov naredi, da sudo ni dostopen vsakemu uporabniku?

Ne, to ne zadošča. sudo lahko še vedno zažene vsak uporabnik:

-rwsr-xr-x 1 root root 165976 Jan 26 19:34 /usr/bin/sudo

Ne pomaga, če exec pravice niso omejene na grupo, kar privzeto niso.

Ja, to bi šlo. Ne vem sicer, zakaj ni tako narejeno že privzeto. ???

Sem včeraj dobil to sporočilo za update na strežniku... in odstranil sudo.

user@debian:~$ sudo
bash: sudo: command not found
user@debian:~$

Ker ne uporabljam sudo.

Vedno naredim login z navadnim userjem, nato prvi ukaz su, da grem v root, potem pa začnem delat.

Jah, niste še z ubuntujem okuženi ;)

Statistično je čisto enako verjetno, da bo naslednjič exploit na su komandi. Tak da z neuporabo sudo ne pridobiš nič.

CentOS :P

Xfce.

Openbox master race.

Invictus je 27. jan 2021 ob 10:46 izjavil:

Ja, je, ampak to je za uporabnike... načeloma to niso strežniki.

Tale lista je precej dobra... Uporabiš, kar misliš, da je pametno...

https://www.cyberciti.biz/tips/linux-se...

Zelo dober seznam, ja. Edino malo zastarel je, točka 16 (Disable Unwanted Linux Services) se danes preverja malo drugače. Če imaš Upstart, potem rečeš

sudo initctl list

, System V (ta je danes kar privzeti) pa

sudo service --status-all

ter recimo

sudo systemctl list-unit-files --type=service

Onemogočanje USB/firewire/thunderbolt naprav se mi zdi tak nice touch, ampak jaz raje uporabljam USBGuard.

Mimogrede, noowner datoteke so na desktopu po navadi... tadaaaa: Adobe Acrobat Reader. Yup, that crap.