Hector Martin

Just putting some things together regarding the latest “sudo” exploit. If you haven't heard yet, there is a new exploit, which allows running commands as root in a particular configuration. More details: https://www.openwall.com/lists/oss-security/2019/10/14/1https://thehackernews.com/2019/10/linux-sudo-run-as-root-flaw.html … https://thehackernews.com/2019/10/linux-sudo-run-as-root-flaw.html … (1/4)

Although the exploit is pretty cool, the actual implementation of it in-the-wild is probably quite rare. A brief explanation: https://twitter.com/marcan42/status/1184134959268675584?s=19 … (2/4)

Also, I have seen the miss-usage of @MITREattack here. Instead of using "T1068 - Exploitation for Privilege Escalation", people mistake with "T1169 - Sudo". The mitigations and detection for each are quite different. (3/4)