Hacker News Reader

Comment by ollybee | Hacker News Reader

You have my attention, what is this recent sudo bug?

https://news.ycombinator.com/item?id=25919235

As a tip for the future, in case you're interested: you can use hn.algolia.com, search "sudo", time window something like "past month", and you'd have found it.

It is much more efficient and future-proof to have someone put the exact link as a reply, that way people coming to the thread afterwards can simply click on.

I gave the full link, and additionally gave a tip for those who were interested.

hn.algolia.com is a great resource and I'm certain not everybody here knows about it.

Thanks for teaching these men to fish. I thought I was going to need to do all the explaining.

Not every man needs to fish, we live in a society with specialization. Some people can do the fishing and some can do other things.

Would be nice if everyone knew how to wipe their own ass though.

How do you know they are men?

They don't. They're referring to a famous proverb.

I appreciate when you give me the fish, and also show me how to fish (or even remind me where the fish are).

duckduckgo has a !bang for hacker news `sudo !hn` redirects to hn.algolia.com with the thread at the top of the list

Oh cool, didn't know that!

Discussed here: https://news.ycombinator.com/item?id=25919235

Though they would have had to also get into the admin server running (probably) WHMCS.

The sudo bug would let a hacker take over a server where the customer code ran, but not the main admin server. They would have needed some other weakness to get that. Perhaps aided by owning one of the customer servers.

I think it's this one, which came to light last month:

https://www.linux-magazine.com/Online/News/Decade-Old-Sudo-F...

Edited to add: Here's another article about it (you should be able to find quite a few more, too):

https://www.theregister.com/2021/01/26/qualys_sudo_bug/

https://www.beyondtrust.com/blog/entry/understanding-sudo-vu...

Reply on news.ycombinator.com