Apple has rolled out a fix for a critical sudo vulnerability in macOS Big Sur, Catalina, and Mojave that could allow unauthenticated local users to gain root-level privileges on the system.
“A local attacker may be able to elevate their privileges,” Apple said in a security advisory. “This issue was addressed by updating to sudo version 1.9.5p2.”
Sudo is a common utility built into most Unix and Linux operating systems that lets a user without security privileges access and run a program with the credentials of another user.
Tracked as CVE-2021-3156 (also called “Baron Samedit“), the vulnerability first came to light last month after security auditing firm Qualys disclosed the existence of a heap-based buffer overflow, which it said had been “hiding in plain sight” for almost 10 years.
The vulnerability, which was introduced in the code back in July 2011, impacts sudo versions 1.7.7 through 1.7.10p9, 1.8.2 through 1.8.31p2, and 1.9.0 through 1.9.5p1, following which the maintainers released 1.8.32 and 1.9.5p2 to resolve the issue.
While the weakness can only be exploited by an attacker already having access to a vulnerable host, the barrier could be easily bypassed by…
http://feedproxy.google.com/~r/TheHackersNews/~3/PCUlk8WHpbM/apple-patches-10-year-old-macos-sudo.html