Re: sudo and UNIXes
On Sun, Oct 27, 2013 at 09:28:51PM -0600, Joe Pfeiffer wrote:
> Reco <recoverym4n@gmail.com> writes:
> > True, you need to add to the picture that curious user who just read on
> > Bugtraq or Full Disclosure about fresh vulnerability in sudo. Or that
> > disgruntled user who needs /etc/system changed right here and now. Or
> > that developer who needs to do this 'small change, nobody will notice'
> > on a production server.
> > And if you don't have such people there - good for you, as here we can
> > always find such person here.
>
> You also have to add to the picture such a vulnerability, and I haven't
> noticed any.
If we're speaking of public vulnerabilities:
CVE-2010-0427.
CVE-2013-1775 (allows bypass sudoders modification to retain root
privileges).
I have no knowledge about private 0days.
Reco
Reply to: