PWFeedback Buffer Overflow Vulnerability in Sudo - is Ubuntu affected by this?

[ardouronerous]

http://www.youtube.com/watch?v=5QwclIBQ5A0

Thanks.

[bernard010]

Sudo utility that under a specific configuration could allow low privileged users or malicious programs to execute arbitrary commands with administrative ('root') privileges on Linux. The flaw can only be exploited when the "pwfeedback" option is enabled in the sudoers configuration file, a feature that provides visual feedback, an asterisk (*), when a user inputs password in the terminal. When pwfeedback is enabled, the vulnerability can be exploited by any user, even without sudo permissions. To determine if your sudoers configuration is affected, you can run "sudo -l" command on your Linux terminal to find whether the "pwfeedback" option is enabled and listed in the "Matching Defaults entries" output.
If enabled, you can disable the vulnerable component by changing "Defaults pwfeedback" to "Defaults !pwfeedback" in the sudoers configuration file to prevent the exploitation of the privilege escalation vulnerability.
Sudo, stands for "superuser do," is a system command that allows a user to run applications or commands with the privileges of a different user without switching environments—most often, for running commands as the root user. I intend to be more cautious with sudo, firewall configuration, etc.

[Bashing-om]

ardouronerous; Hello -

No, ubuntu is not affected by default:

sudo -l

sysop@x1804mini:~$ sudo -l
[sudo] password for sysop:
Matching Defaults entries for sysop on x1804mini:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
insults

User sysop may run the following commands on x1804mini:
(ALL : ALL) ALL
sysop@x1804mini:~$

"pwfeedback," is not in the list

See: https://arstechnica.com/information-...-gets-a-patch/

-my bit to help-

[ardouronerous]

Thanks for the clarification.

[wildmanne39]

Thread moved to Security a more appropriate sub-forum.