A recently revealed report has worried Linux users. Vulnerability analysis specialists have disclosed a new security flaw in Sudo, one of the most common and important utilities, which is also included as a core command installed in almost any Linux and UNIX-based implementation.
“This security flaw is a problem of bypassing security policies in Sudo. If exploited, it would allow a threat actor or malicious program to execute arbitrary commands as root on the compromised system even when system configurations explicitly prohibit root access,” the experts mention.
It should be noted that Sudo (superuser do) is a system command that allows users to run applications or commands with another user's privileges without needing to change environments. According to vulnerability analysis experts, it is commonly used to execute commands as the root user.
In most Linux distributions, the keyword ALL in the RunAs specification of the /etc/sudoers file allows any user in the admin or sudo groups to run any command as any validated user on the system. This is a default configuration.
Thanks to privilege separation (a fundamental security feature in Linux), an administrator can configure a “sudoers” file to establish which users can run certain commands. This vulnerability consists of any user being able to execute a specific command as the root user, which would allow full control of the environment.
Identified as CVE-2019-14287, this vulnerability was discovered by vulnerability analysis expert Joe Vennix. In his report, he notes that this is a flaw of considerable severity, as the sudo utility was designed to allow users to use their own login credentials to execute commands without administrators having to provide them with a password.
