Easier approach to exploit sudo 1.9.4 and later versions (ineffective NO_ROOT_MAILER bug)

[0xdea]

A new approach was identified that should considerably simplify exploitation against sudo versions starting from 1.9.4:
https://seclists.org/oss-sec/2021/q1/88

It might be worth checking it out and implementing it in your exploit.

[blasty]

Thanks for the headsup. Do we know which distros besides Debian Bullseye shipped a sudo (at some point) that was vulnerable to the ineffective NO_ROOT_MAILER hardening?

[0xdea]

Based on a quick search of the coverage table provided by Qualys at the end of their blog post (https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit), I'd say that at least the following additional Linux distributions should be vulnerable:

• Gentoo (https://security.gentoo.org/glsa/202101-33)
• Fedora (https://bodhi.fedoraproject.org/updates/FEDORA-2021-8840cbdccd, https://bodhi.fedoraproject.org/updates/FEDORA-2021-2cb63d912a)