Open Source Development

Power Open Source Development

Explore the open source tools and capabilities for building and deploying modern applications on IBM Power platforms including AIX, IBM i, and Linux.


#Power


#Power

 View Only
Back to discussions
Expand all | Collapse all

Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

  • 1.  Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

    Posted Wed March 17, 2021 03:24 AM
    I  am running Sudo version 1.8.20p2 on AIX7.1.   I have followed  the steps outlined in the IBM Power Systems Community site to check if my current sudo version is vulnerable to the security issue reported in CVE-2021-3156.  Below are the results.

    [/opt/sudo]>./bin/sudoedit -s
    usage: sudoedit [-AknS] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...

    [/opt/sudo]>./bin/sudoedit -s /
    Password:

    According to the explanation my sudo version is not vulnerable.   

    Can IBM confirm that my version is not vulnerable?

    Below is the link to the article:
    AIX Open Source

    ------------------------------
    Nejdet Sami
    ------------------------------

    #AIXOpenSource


  • 2.  RE: Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

    Posted Thu March 18, 2021 01:22 PM

    Hey Nej,

    That's is vulnerable.

    A vulnerable version of sudo will either prompt for a password or display an error similar to:

    sudoedit: /: not a regular file

    https://www.sudo.ws/alerts/unescape_overflow.html



    ------------------------------
    Dennis Mathews
    ------------------------------

    Original Message


  • 3.  RE: Testing vulnerability reported in CVE-2021-3156 for SUDO running on AIX

    Posted Thu March 18, 2021 06:40 PM

    Thanks Dennis

     

    I have decided to install sudo-ldap.1.9.5p2 package.   It seems to have fixed the issue.  Below is the output of "sudoedit -s /"

     

    # ./sudoedit -s /

    usage: sudoedit [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file

     

    Nej

     




    Original Message


Related Content