CVE-2019-14287: Sudo Bug Allows Restricted Users to Run Commands as Root

Re:CVE-2019-14287: Sudo Bug Allows Restricted Users to Run C... by hannob on Tuesday October 15, 2019 @09:55AM (#21258347)

This is technically an interesting bug, but the implications are very minor. The only situation where this can be exploited is when you allow a user to execute something as any other users except root. This seems pretty obscure and probably affects only an extremely small number of configurations.

Pretty much all the headlines I saw on this were overstating or stretching the impact.

[ Parent | on HN ]

Re:CVE-2019-14287: Sudo Bug Allows Restricted Users to Run C... by cracauer on Tuesday October 15, 2019 @11:05AM (#21259195)

No question about the headlines overstating.

But I don't think this is a rare situation. For example you can allow a bunch of users to restart and change a buildbot infrastructure (which runs as its own user, not root).

[ Parent | on HN ]

Re:CVE-2019-14287: Sudo Bug Allows Restricted Users to Run C... by derekp7 on Tuesday October 15, 2019 @11:23AM (#21259404)

But you are giving them access to that specific build user, not "ALL" followed by "!root".

[ Parent | on HN ]

Re:CVE-2019-14287: Sudo Bug Allows Restricted Users to Run C... by stevekemp on Tuesday October 15, 2019 @10:12AM (#21258524)

Agreed it is not likely to hit many people in production, but the writeup on the oss-security post, linked to below is a fascinating reminder of deeply buried assumptions buried, that make security hard.

[ Parent | on HN ]