Bugzilla – Bug 142
arbitrary character injection
Last modified: 2010-06-18 16:20:02 MDT
A Debian user has pointed out that it is possible for a program called by sudo to inject arbitrary characters into the caller's keyboard buffer, potentially allowing unexpected execution of commands in the caller's environment. I'm treating this as a request to enhance the perceived security of sudo rather than as a bug... feel free to react more urgently if you so choose.
This doesn't seem like a huge deal to me since it requires the user to run a malicious program via sudo (and sudo does at least move the current directory to the end of your path). Furthermore, you really don't want programs run by sudo to be session leader or you lose job control IIRC. I suppose sudo could allocate a new pty that gets used by the program being run but that also requires a persistent sudo process and probably causes issues for job control too. I'll think about this some more the next time I do work on a sudo overhaul.
Sudo 1.7.3 has support for running commands in a pseudo-tty which will defeat ths kind of attack. I'll be releasing a new 1.7.3 beta soon.
Sudo 1.7.3's use_pty option can be used to avoid this issue. 1.7.3 is in beta now with GA due at the end of June