Bug 142

Summary: arbitrary character injection
Product: Sudo Reporter: Bdale Garbee <bdale>
Component: SudoAssignee: Todd C. Miller <Todd.Miller>
Status: RESOLVED FIXED    
Severity: enhancement    
Priority: normal    
Version: 1.6.7   
Hardware: PC   
OS: Linux   
URL: http://bugs.debian.org/262454

Description Bdale Garbee 2004-08-02 10:54:31 MDT 
A Debian user has pointed out that it is possible for a program called by sudo
to inject arbitrary characters into the caller's keyboard buffer, potentially
allowing unexpected execution of commands in the caller's environment.

I'm treating this as a request to enhance the perceived security of sudo rather
than as a bug... feel free to react more urgently if you so choose.
Comment 1 Todd C. Miller 2004-08-05 17:06:35 MDT 
This doesn't seem like a huge deal to me since it requires the user to run a malicious program via 
sudo (and sudo does at least move the current directory to the end of your path).  Furthermore, you 
really don't want programs run by sudo to be session leader or you lose job control IIRC.  I suppose 
sudo could allocate a new pty that gets used by the program being run but that also requires a 
persistent sudo process and probably causes issues for job control too.  I'll think about this some 
more the next time I do work on a sudo overhaul.
Comment 2 Todd C. Miller 2010-06-08 11:12:34 MDT 
Sudo 1.7.3 has support for running commands in a pseudo-tty which will defeat ths kind of attack. I'll be releasing a new 1.7.3 beta soon.
Comment 3 Todd C. Miller 2010-06-18 16:19:27 MDT 
Sudo 1.7.3's use_pty option can be used to avoid this issue.  1.7.3 is in beta now with GA due at the end of June