Hacker News Reader

How does this story not have a billion upvotes? HN should introduce sticky posts just for this bug and keep it at the top of the homepage for weeks.

> exploitable by any local user [...] without authentication

> introduced in July 2011 [...] in their default configuration

> full root privileges

Thanks for sharing this. I was looking for it on the mercurial repo at sudo.ws, but the commit didn't match. I found it here: https://www.sudo.ws/repos/sudo/rev/f666191a4e80