Re: Red Hat 9: free tickets

On Sun, Jul 06, 2003 at 12:30:34PM -0700, Stephen Samuel wrote:
> The way it works is:

Actually, I'm not sure this entirely true. Well, it is, but there is another important condition that must be met for this (or similar) attacks to work properly -- /var/run/sudo/$USER/ must exist. This means that the user must have previously sudo'd at lease once and /var/run/sudo/$USER/ will have been created.

I'm sure there are ways to work around this, but in my experiments, /var/run/sudo/$USER/ must exist if you hope to exploit something like this with the predictable file name creation + symlink trick.

-jon Received on Fri Jul 11 19:55:30 2003