Davy
04-12-2005, 06:51 PM
http://www.pcmag.com/article2/0,1759,1784705,00.asp
Security Watch: Could sudo Compromise Mac OS?
Top Threat: sudo Root Compromise
Executive Summary
Name: sudo Root Compromise
Affects: Mac OS X 10.3.x confirmed, probable on all platforms running sudo
Details
A Trojan horse program run by a user with admin privileges can utilize the sudo utility program to execute as the root user.
The original report on this vulnerability described it as a problem with Mac OS X, but a subsequent report indicates that it applies to any platform on which sudo is run.
The problem is tied to default settings for sudo: Under which a five minute grace period exists after running it during which sudo may be run without again providing a password. The execution context for sudo is system-global for the user, and not tied to a particular terminal session. Finally, the log file used by sudo (/var/log/system.log) is readable by anyone in the admin group.
Given these settings, the Trojan program waits for changes to be written to the /var/log/system.log and looks for entries that would elevate the user context of the Trojan. It then has five minutes to execute sudo with any command to elevate its own privileges.
How to avoid it:
According to the initial report, any of these steps will correct the problem:
* Add the following lines to the /etc/sudoers file, in the "Defaults" section:
Defaults:ALL !syslog
Defaults:ALL logfile=/var/log/secure.log This redirects the sudo logs to /var/log/secure.log (which has the appropriate permissions and is a more appropriate log for authentication components)
* Add the following line to the /etc/sudoers file, in the "Defaults" section:
Defaults:ALL timestamp_timeout=0 This removes the password grace period and forces the user to authenticate every time sudo is run.
* Add the following line to the /etc/sudoers file, in the "Defaults" section:
Defaults:ALL tty_tickets This limits the sudo grace period to individual ttys (terminal sessions) and makes it much more difficult for a Trojan to compromise the system using this technique.
The author of the advisory recommends that you use the Visudo tool to edit the /etc/sudoers file. This utility will check your syntax, keeping you from corrupting your file.
Security Watch: Could sudo Compromise Mac OS?
Top Threat: sudo Root Compromise
Executive Summary
Name: sudo Root Compromise
Affects: Mac OS X 10.3.x confirmed, probable on all platforms running sudo
Details
A Trojan horse program run by a user with admin privileges can utilize the sudo utility program to execute as the root user.
The original report on this vulnerability described it as a problem with Mac OS X, but a subsequent report indicates that it applies to any platform on which sudo is run.
The problem is tied to default settings for sudo: Under which a five minute grace period exists after running it during which sudo may be run without again providing a password. The execution context for sudo is system-global for the user, and not tied to a particular terminal session. Finally, the log file used by sudo (/var/log/system.log) is readable by anyone in the admin group.
Given these settings, the Trojan program waits for changes to be written to the /var/log/system.log and looks for entries that would elevate the user context of the Trojan. It then has five minutes to execute sudo with any command to elevate its own privileges.
How to avoid it:
According to the initial report, any of these steps will correct the problem:
* Add the following lines to the /etc/sudoers file, in the "Defaults" section:
Defaults:ALL !syslog
Defaults:ALL logfile=/var/log/secure.log This redirects the sudo logs to /var/log/secure.log (which has the appropriate permissions and is a more appropriate log for authentication components)
* Add the following line to the /etc/sudoers file, in the "Defaults" section:
Defaults:ALL timestamp_timeout=0 This removes the password grace period and forces the user to authenticate every time sudo is run.
* Add the following line to the /etc/sudoers file, in the "Defaults" section:
Defaults:ALL tty_tickets This limits the sudo grace period to individual ttys (terminal sessions) and makes it much more difficult for a Trojan to compromise the system using this technique.
The author of the advisory recommends that you use the Visudo tool to edit the /etc/sudoers file. This utility will check your syntax, keeping you from corrupting your file.