Sudo (superuser do) allows a system administrator to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while logging the commands and arguments.
A flaw in exists in sudo's -e option (aka sudoedit) that can give an attacker read permission to a file that would otherwise be unreadable.
Credit:
The information has been provided by Reznic Valery.
The exploit code has been provided by Angelo Rosiello.
While sudoedit runs the actual editor as the invoking user, the temporary file is then re-opened with root privileges. An attacker can run sudoedit, remove the editor temporary file, make a link to an unreadable file with the same name as the old temporary file and quit the editor. The file being edited via sudoedit will now contain a copy of the previously unreadable file.
Impact:
Exploitation of the bug requires that the sudoers file be configured to allow the attacker to run sudoedit. If no users have been granted access to sudoedit there is no impact.
Summary:
A flaw in exists in sudo's -u option (aka sudoedit)
in sudo version 1.6.8 that can give an attacker
read permission to a file that would otherwise be
unreadable.
All the information that you can find in this software
were published for educational and didactic purpose only.
The author published this program under the condition
that is not in the intention of the reader to use them
in order to bring to himself or others a profit or to bring
to others damage.
!Respect the law!
How do I use this code ?
To exploit sudoedit you have to open with it the
file "rosiello" as shown in the example.
EXAMPLE SCENARIO:
1) Open two shells (i) and (ii);
2) (i)$sudoedit rosiello;
3) (ii)$./sudoedit-exploit /etc/shadow;
4) (i) close sudoedit.
The file "rosiello" is now a copy of "/etc/shadow".
