Joe Vennix of Apple security has found another significant vulnerability in sudo utility that under a specific configuration could allow low privileged users or malicious programs to execute arbitrary commands with administrative ('root') privileges on Linux or macOS systems.

Sudo is one of the most important, powerful, and commonly used utilities that comes as a core command pre-installed on macOS and almost every UNIX or Linux-based operating system.

Sudo has been designed to let users run apps or commands with the privileges of a different user without switching environments.

Sudo is an important utility within macOS and other Unix-based systems, including Linux, with it typically used to run administrative commands with the security privileges of a superuser or "root." It is a well-used element of system maintenance and configuration via the Terminal, and has the potential to cause havoc if misused.

Found by Apple security employee Joe Vennix, the vulnerability in sudo is a privilege escalation vulnerability, one that has been given the tracking code CVE-2019-18634. At its core, the vulnerability can allow a user that doesn't typically have permissions to perform tasks that require administrative access to do just that.

For versions of sudo before 1.8.26, The Hacker News reports a stack-based buffer overflow issue is present, requiring the "pwfeedback" option to be enabled within the sudoers configuration file. The feature provides users with an asterisk when they input a password into Terminal.

According to the latest report published by The Debian Project, a Sudo vulnerability exists that allows hackers to gain access to root privileges and execute commands.

The vulnerability exists in the Sudo package (Sudo stands for “superuser do”) which allows users to execute programs and commands with security privileges of a superuser.

Linux and macOS systems have been hit by a nasty little bug in the Sudo utility, although the good news is it has already been patched.

Sudo is a tool that provides a specified user permissions above their normal levels, including root (administrative) access, but by leveraging this security flaw, it’s possible a low-privileged user (or malware) could get unauthorized root access, and thus potentially wreak all sorts of havoc on the host system.

There is a stack buffer overflow in several versions of the sudo utility that could let an unprivileged user gain root privileges on a vulnerable system.

The vulnerability is in versions 1.7.1 to 1.8.25p1 of sudo, the powerful utility that is ubiquitous on Linux and Unix-based systems. Sudo allows an administrator to give individual users or small groups the power to run commands as root. The utility logs those commands and the associated arguments and it runs per command.

In the vulnerable versions, an attacker could take advantage of a pair of separate flaws in order to gain root privileges. The vulnerability lies in the way that the “pwfeedback” option handles some input. That option is used to show an asterisk in the password field whenever a user presses a key.

Sudo, a utility found in dozens of Unix-like operating systems, has received a patch for a potentially serious bug that allows unprivileged users to easily obtain unfettered root privileges on vulnerable systems.

The vulnerability, tracked as CVE-2019-18634, is the result of a stack-based buffer-overflow bug found in versions 1.7.1 through 1.8.25p1. It can be triggered only when either an administrator or a downstream OS, such as Linux Mint and Elementary OS, has enabled an option known as pwfeedback. With pwfeedback turned on, the vulnerability can be exploited even by users who aren't listed in sudoers, a file that contains rules that users must follow when using the sudo command.

Sudo is a powerful utility that’s included in most if not all Unix- and Linux-based OSes. It lets administrators allow specific individuals or groups to run commands or applications with higher-than-usual system privileges. Both Apple’s macOS and Debian distributions of Linux received updates last week. People using other OSes should check their configurations and version numbers to ensure they’re not vulnerable.

Ironically, pwfeedback was meant to make life a bit more secure for users. When enabled, it prints asterisks (*) to the screen when you enter your sudo password.

Unfortunately, it also made it easy to cause a stack-based buffer overflow. Then, as sudo developer Todd C. Miller warns, "Because the attacker has complete control of the data used to overflow the buffer, there is a high likelihood of exploitability."

Whoops.

The good news is pwfeedback isn't enabled by default. The bad news is that sysadmins often do enable it. Worse still, it's enabled by default in at least two popular Linux distributions, Elementary OS and Linux Mint.

Fortunately, the fix is already in on most operating systems. The bug is fixed in sudo 1.8.31 and later. It's now in the most recent security updates to all major Linux distributions and macOS. So, you should patch it immediately.

If there is no patch available for your operating system, you can fix the problem by deactavating pwfeedback. First check to see if you're vulnerable by running the command:

sudo -l

The security flaw resides in the pwfeedback option, which is enabled by default on distros like Linux Mint and elementary OS. Because of the bug, any user can trigger a stack-based buffer overflow even if they aren’t listed in the sudoers file.

The vulnerability exists in versions 1.7.1 to 1.8.25p1, but versions 1.8.26 through 1.8.30 can be abused because they include changes in EOF handling that block such an exploit. Sudo 1.7.1 was released on April 19, 2009, while the first patch version (1.8.26) landed on September 17, 2019, so the bug is about 10 years old.

Sudo, a standard tool on Unix-y operating systems that lets select users run some or all commands as root, can be exploited to give superpowers to any logged-in user – if deployed with a non-default configuration.

This security hole, discovered by Joe Vennix at Apple Information Security, is only active if the pwfeedback option is enabled. This option shows an asterisk each time a key is pressed, when entering a password. The good news is that pwfeedback is generally disabled by default.

Details of a nine-year-old security vulnerability with the sudo utility found in numerous Unix and Linux based operating systems have been revealed.

The flaw, which affects the likes of Linux Mint and Elementary OS, could be exploited to give users root privileges on a vulnerable system. Sudo versions 1.7.1 to 1.8.30 are at risk if the pwfeedback option is enabled.

Sudo has weight as "one of the most important, powerful, and commonly used utilities that comes as a core command pre-installed on macOS and almost every UNIX or Linux-based operating system," said Kumar. Malcolm Owen in AppleInsider also talked about Sudo in general. It has the potential to cause havoc if misused.

"The vulnerability, tracked as CVE-2019-18634, is the result of a stack-based buffer-overflow bug found in versions 1.7.1 through 1.8.25p1," said Ars Technica. "It can be triggered only when either an administrator or a downstream OS, such as Linux Mint and Elementary OS, has enabled an option known as pwfeedback."

In the vulnerable versions, an attacker could take advantage of a pair of separate flaws in order to gain root privileges. The problem was not just a "Mac thing" but AppleInsider made note that the vulnerability was found by an Apple security employee Joe Vennix.

Decipher: "The risk of exploitation is quite high for systems on which the pwfeedback option is enabled. In order to exploit the bug, an attacker would just need to send a large amount of data to sudo through the password prompt field. The vulnerability results from two separate errors in the sudo code."