Decade-old vulnerability is still affecting most Linux distros
Security vulnerability can be exploited on other Unix-based operating systems as well
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Security researchers at Qualys discovered a privilege escalation vulnerability in one of the core utilities present in all Unix-likeoperating systemsincludingLinux.
If exploited, the heap overflow vulnerability in the Sudo utility could allow any unprivileged user to gain root privileges.
The vulnerability, which has now been patched, has existed for almost a decade, according to a blog post byAnimesh Jain, a Vulnerability Signatures Product Manager at Qualys.
Easily exploitable
The Sudo utility allows system admins to delegate limited root privileges to normal users. It’s governed by the sudoers configuration file, which lists the users who can run with elevated privileges. According to Qualys, the vulnerability allowed even normal users not listed in the sudoers files to gain super user privileges.
The vulnerability, which is being tracked asCVE-2021-3156, has been patched earlier today with the release of Sudo v1.9.5p2.
According to reports, there have been two other security flaws in the sudo utility that were disclosed over the past two years. The latest one however is considered to be the most damaging of the lot, since it wasn’t too difficult to exploit.
In fact, Qualys created three exploits based on this vulnerability and managed to obtain full root privileges onUbuntu 20.04(which uses Sudo 1.8.31),Debian 10(with Sudo 1.8.27), and Fedora 33 (with Sudo 1.9.2).
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Since Sudo is used by virtually all Unix-like operating systems including the various BSDs, Jain says that other operating systems and distributions are also likely to be exploitable.
Via:ZDNet
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Google puts Nvidia on high alert as it showcases Trillium, its rival AI chip, while promising to bring H200 Tensor Core GPUs within days
A new form of macOS malware is being used by devious North Korean hackers
OLED vs Mini-LED: which TV type is best?
