Disclosure: Possible problems with ‘sudo’ package

During a recent client assessment, I discovered what I thought to be a bug in the ‘sudo’ package. After further investigating and talking with Todd C. Miller (the maintainer of ‘sudo’), I was informed that it was not a bug, but expected behavior under a default install. The reason for this post it to make sure everyone is aware of
this behavior and of the potential security concerns involved, no matter how obscure or how hard to exploit.

This was found to be true on basically all platforms.

Under a default installation, there are two elements that create the potential problem:

1) ‘sudo’ is designed to allow a user to execute a command under elevated (root) privilege. To do so, the user must type his/her password for authentication. To avoid repeated typing of the user password, ‘sudo’ generates a 5 minute cache. This allows the user to type in additional ‘sudo’ commands with the assumption
that authentication has already been performed. \

2) If a user logs in, and then executes sudo on a TTY (ttya1 for example), then logs in again on another TTY (ttya2) and executes sudo again, there is no check to ensure that the password cache is applied to the first TTY (ttya1) only. Instead, the cache works for BOTH ttya1 and ttya2. This creates a five minute window for a second user to ‘piggy-back’ off the cache generated on the first TTY ‘sudo’.

The first argument against this being a problem is that if a user logs in with the password, they can simply use that to authenticate themselves to ‘sudo’ as well. However, several scenarios exist that could allow an attacker to gain a shell with user priv’s, without logging in. Some of them include: Spawning shells via IRC scripts (BitchX), IRC bots (eggdrop), or via httpd (poorly coded CGI scripts) may allow the attacker to gain the shell. From there, with ‘sudo’ under a default installation, the attacker could then ‘piggyback’ off the password cache and gain unauthorized root access.

Solution: Fortunately, Todd Miller has already addressed these issues in most distributions past and present:

1) ‘sudo’ can be configured for an alternate timeout value.

Suggestion: Decrease the alternate timeout value to ‘1’

2) ‘sudo’ has already been designed with tty-based tickets, and can be enabled with the USE_TTY_TICKETS option.

Suggestion: Enable this feature.

It is recommended that both options be implemented to ensure the security of your machines.

I’d like to thank Mr. Miller for maintaining the ‘sudo’ package, as well as having the foresight to address the potential security concerns as outlined above.

Poetry #27: nom

[This was originally published in F.U.C.K. poetry Issue #27. The publish date is approximate.]

        what's in a name you ask?
          far from divine, it begs why not what
          culture has deemed so much wrong
          we go tiptoing through life, trying..
             not to disappoint
             not to let down
             not to..
          my ruling passion is spilled out in name
          name with no apparent explanation
          silently damn one for bearing my cross
          it's so much more though
          with my name comes admission
          unto no other can i pass those weights
          doomed to verbal crucifixion
          seeking escape but not knowing
          mindless incoherent sleep made thought
             still no escape
                mea culpa
          let me burn now, for i have taken my pain in your presence

#563: can it feel this wrong?

[F.U.C.K. is an e-zine that I started on January 24, 1993 and ended on January 24, 2000. One concept is that articles should be timeless if possible, so they were not released with dates. As such, the date on this blog is not exact but I will try to use a date as close as possible.]

there are some fundamental problems with me, and i am fully aware of that as fact. if anyone is qualified to say that about another person, self is always it. is my new obsession part of that problem? i’d love to know. as i reconsider my intro, i think i am just different. that we all find beauty in different places, and that i am just looking in a new place.

recently i have found myself liking a new kind of art. well, to qualify i guess i should say that it is likely only i consider it art. the turning point that made me realize this came the other day while out of town. i sat there looking at someone enthralled by the anguish on her face. it made me think back to the CD cover for Heavenly Voices i recently purchased. the cover is adorned with a woman’s face in what appears to be guilt ridden pain.

shortly after seeing her face i realized that the expression she had was cause of my joy. all this time, i had taken pleasure in other’s pain, or more directly, the reflection they had taken of their own pain. even more specifically, a beautiful female face wearing the look of guilt or sorrow.

here is an excerpt from a sort of journal i keep, detailing my thoughts immediately after the encounter:

“drizzling rain, steady bumps. one nice thing to an otherwise depressing day. Atlanta transit the one hour stage for today. Returning to the airport she sat across from me. Friendly smile before reading to pass the time. Exchanged time of day for brief eye contact.

i sat there contemplating my day occasionally glancing over. her face etched out emotional yin yang and drew me in. corners of her mouth turned up, as if she was truly happy. eyes and brow a contradiction to that happiness. the anguish etched in her face had sat with her for a long time. it was as if i could feel her pain and suddenly understand the hurt. one second and all i could read was guilt on her brow. what had she done that weighed so heavily?

the buzzer sounded and the train stopped. the doors parted as she stood up. with a gentle smile she bid me good day. her happy facade had returned and she left me there to ponder her guilt for her.”

I think back to her sitting there, staring down at the floor thinking about whatever consumed her. I wanted to go over and just touch her face. To feel the pain etched in it. Run my finger along the contours of her face.

The thought of guilt, sin, confession, attrition, and other raw emotions fascinates me. I find parts of them beautiful to say the least. It is difficult for me to describe the relationship between the pain and the inherent beauty I see in it.

discussion on said topic the other day lead to an interesting comment by a new friend. she said “pain is one of the most base emotions.. and a certain naivete is put forth by a genuine display of pain.” it didn’t hit me until over a week later that what she said is dead on.

think about it. society says not to show pain or any emotion at all. showing something so ‘bad’ and ‘primitive’ is a sign of weakness. to actually show emotion brands you with the label of ‘pansy’ or some other inadequate insult. to show such emotion is more often than not done under the guise of art, or by young people. young people who are naïve about what light they will be held in after doing so.

as well know, what society deems acceptable is hardly an appropriate guideline these days. with such a minority leading the way assigning values to social and philosophical elements, its easy to get tied up in what they decree. what better way to shirk free thought and give up control or say in your life. but we have gone down this rant before, and the issue at hand is so much more elegant. the face of pain…

as i sit here reviewing what i wrote, i can’t help but to think how poor a job i have done in describing what i originally set out to. how do you adequately describe something you find so beautiful? give them something as an example? will that one example really make them understand how it affects you? of course not. perhaps telling them what extreme you would go through to convey the point? why bother. all i know is that i sit here at night sometimes, staring at the faces of women in pain. when i do, things seem so clear and calm.

i look back to my trip to Atlanta, and i can picture her face perfectly. no details of her, the train, or my feelings are lost and i have this feeling they will stay with me. we all feel pain at times. unfortunately, we have been told that pain is unconditionally bad, when more often than you might expect, it is good. if nothing else, it certainly allows us to enjoy pleasure all the more.