Sudo Bug Impacting macOS, Not Just Linux and BSD, Expert Says

Last week, a Sudo app bug has been discovered by security researchers from the Qualys, which is known to affect not only the app but also Linux and BDS--and now, it seems like the bug is also affecting Apple's very own operating system: macOS.

The Root-Giving Sudo Bug Exploit

According to a report by ZDNet, the vulnerability, which is known as CVE-2021-3156 or the Baron Samedit, allowed the Qualys researcher to trigger a "heap overflow" bug in the app that changes the current user's low-privileged access to root-level commands, meaning that they can gain full access to the entire system.

For those unaware, Sudo is an app that allows admins to delegate limited root access to other users.

Attackers don't require much to pull out the attack, as there is only one condition needed to exploit the bug: the attacker should have access to the system they want to hack.

Unfortunately, this could be done easily by infecting the system with malware, or they could brute-force low-privileged service accounts.

What's even more surprising is that the bug has apparently been around for a decade already as it has been introduced into the Sudo code in July 2011, impacting all Sudo versions to have come out in the past ten years.

Based on the report by Qualys researchers last week, they have only tested the bug exploit on Fedora, Ubuntu, and Debian and that the bug would most likely affect BSD, which is an operating system that is often shipped with Sudo.

Nevertheless, they also believe there are UNIX-like systems that have been affected.

Recent macOS Versions Affected

Now, it turns out that the latest version of macOS, an Apple-exclusive operating system, also ships with the Sudo app, which means the latest version could also be affected by the root-giving bug exploit.

The news comes from Matthew Hickey, the co-founder of Hacker House and a security expert, who tested the same Baron Samedit vulnerability and found that the bug could be exploited with just a few modifications that could grant attackers root-level access to Mac devices.

"To trigger it, you just have to overwrite argv[0] or create a symlink, which therefore exposes the OS to the same local root vulnerability that has plagued Linux users the last week or so," Hickey said in an interview with the news outlet.

New Apple Security Patch Likely to Roll Out Soon

Hickey's discovery has been independently confirmed by Patrick Wardle, one of the leading macOS experts these days, as well as Will Dormann, a vulnerability analyst from the CERT Coordination Center at the Carnegie Mellon University.

Sudo app has patched the vulnerability last week, and Apple delivered an update as well this Monday, February 1, 2021.

However, Hickey said that despite the Apple update, the bug can still be exploited and used for any attacks on the latest version of the macOS and that he had reached out to the tech giant regarding the issue.

As of now, the company is yet to comment but is highly likely that another security patch would be rolled out in the coming days, seeing as the Baron Samedit exploit is definitely a serious security problem.

This article is owned by Tech Times

Written by: Nhx Tingson