Stay Ahead With Linux Security News

security advisorycriticalheap overflow

Critical Sudo Heap Overflow Vulnerability CVE-2021-3156 in Linux

Like any OS, Linux and Unix OSes require regular patching - but as security professionals, ethical hackers, and criminal hackers will tell you, regular Linux and Unix patching is often neglected. Learn about a new critical rated Linux\Unix vulnerability you can't afford to ignore. . Last week (26th January 2021) a new critical rated Linux\Unix vulnerability was made public under CVE-2021-3156 . Specifically, the vulnerability is within the ‘sudo’ program, which is an abbreviation of ‘superuser do‘, well that’s how I remember it. Sudo is a powerful and fundamental program found within all Linux and Unix distributions, allowing users to execute programs with the security privileges of another user. A typical use of sudo is where you need to run a program with privilege level (i.e. administrator) access rights. The sudo ‘heap overflow’ vulnerability was discovered by Qualys researchers, the exploit allows any unprivileged user to gain root level (i.e. administrative) privileges. Qualys has posted a blog and video which explains and demonstrates the exploitation technique, which as exploits go is fairly quick and easy to do. See CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit) | Qualys Security Blog The link for this article located at Security Boulevard is no longer available. . A serious vulnerability in the sudo command on Linux and Unix systems enables non-privileged users to obtain root-level permissions. Take immediate action!. Sudo Flaw, Heap Overflow, User Privilege Escalation. . Brittany Day

Feb 08, 2021 • Brittany Day Security Vulnerabilities