Sudo interpretation of wildcard like /var/log/messages* can indirectly expose a security risk
Issue
-
Sudo interprets wildcard arguments allows for multiple arguments rather than a single file argument.
-
Given the rule:
# Allow user unixro to view any of the /var/log/messages log files
unixro ALL=NOPASSWD: /bin/cat /var/log/messages*
- Running the following results in the /var/log/messages content AND the /etc/shadow content to be displayed on the terminal.
sudo /bin/cat /var/log/messages /etc/shadow
Environment
- Red Hat Enterprise Linux 4, 5 and 6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
