AIX Open Source

AIX Open Source

Share your experiences and connect with fellow developers to discover how to build and manage open source software for the AIX operating system

 View Only
Back to discussions
Expand all | Collapse all

Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

  • 1.  Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

    Posted Wed March 17, 2021 03:24 AM
    I  am running Sudo version 1.8.20p2 on AIX7.1.   I have followed  the steps outlined in the IBM Power Systems Community site to check if my current sudo version is vulnerable to the security issue reported in CVE-2021-3156.  Below are the results.

    [/opt/sudo]>./bin/sudoedit -s
    usage: sudoedit [-AknS] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...

    [/opt/sudo]>./bin/sudoedit -s /
    Password:

    According to the explanation my sudo version is not vulnerable.   

    Can IBM confirm that my version is not vulnerable?

    Below is the link to the article:
    AIX Open Source

    ------------------------------
    Nejdet Sami
    ------------------------------


  • 2.  RE: Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

    Posted Thu March 18, 2021 01:22 PM

    Hey Nej,

    That's is vulnerable.

    A vulnerable version of sudo will either prompt for a password or display an error similar to:

    sudoedit: /: not a regular file

    https://www.sudo.ws/alerts/unescape_overflow.html



    ------------------------------
    Dennis Mathews
    ------------------------------

    Original Message


  • 3.  RE: Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

    Posted Thu March 18, 2021 06:40 PM

    Thanks Dennis

     

    I have decided to install sudo-ldap.1.9.5p2 package.   It seems to have fixed the issue.  Below is the output of "sudoedit -s /"

     

    # ./sudoedit -s /

    usage: sudoedit [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file

     

    Nej

     




    Original Message


Related Content