You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
I wouldn't be surprised if the number of systems affected by the vuln that *aren't* already intrinsically vulnerable to nasty privescs because the configuration is a terrible idea when working as intended is, well, essentially 0.
Since people still don't understand the vulnerable config: you have to allow $someone to sudo into *ANY USER* (not one specifically, *ANY*), which means giving them root, and then add an *exception* to take root away (but still let them become *any* other user).
To illustrate why this is a ridiculous idea and gives you root anyway even if sudo didn't have the bug: 'adm' is a member of 'disk' which can write to raw block devices, so you can just sudo to 'adm' instead of root and edit the sudoers file, or give suid to /bin/sh.
So if there are people there who actually had the sample config in the vuln report, they are vulnerable to all hell and back *anyway*, and if they've been trying to play whack-a-mole by excluding all "root-equivalent" user accounts, that's a ridiculous idea and they'll miss one.
“I need a shell running as the postgres user, or the apache user, and the only tool I know how to use is modifying sudoers, apparently”
I was able to get this to work when my sudoers only permitted a user to sudo to www-data. I didn’t need to permit ALL... unless I’m remembering incorrectly.
I bet your sudoers entry didn't do what you think it did, or there was another sudoers entry overriding. It definitely does not work for me.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
