Sudo Flaw Lets Linux Users Run Commands As Root Even When They’re Restricted

A vulnerability has been discovered in Sudo—one of the
most important, powerful, and commonly used utilities that comes as
a core command installed on almost every UNIX and Linux-based
operating system.

The vulnerability in question is a sudo security policy bypass
issue that could allow a malicious user or a program to execute
arbitrary commands as root on a targeted Linux system even when the
“sudoers configuration” explicitly disallows the root
access.

Sudo, stands for “superuser do,” is a system command that allows a
user to run applications or commands with the privileges of a
different user without switching environments—most often, for
running commands as the root user.

By default on most Linux distributions, the ALL keyword in RunAs
specification in /etc/sudoers file, as shown in the screenshot,
allows all users in the admin or sudo groups to run any command as
any valid user on the system.

So, even if a user has been restricted to run a specific, or
any, command as root, the vulnerability could allow the user to
bypass this security policy and take complete control over the
system.

How to Exploit this Bug? Just Sudo User ID -1 or
4294967295

The vulnerability, tracked as CVE-2019-14287 and discovered by Joe
Vennix of Apple Information Security, is more concerning because
the sudo utility has been designed to let users use their own login
password to execute commands as a different user without requiring
their password.

That’s because the function which converts user id into its
username incorrectly treats -1, or its unsigned equivalent
4294967295, as 0, which is always the user ID of root user.

So, if you use Linux, you are highly recommended to update sudo
package manually to the latest version as soon as it is
available.