Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

CVE-2021-3156 | SUDO Heap-based Buffer Overflow

Barny_Riches
Nimbostratus
Nimbostratus

Are any of the BIG-IP versions affected by the recent SUDO vulnerability announcement? I have checked our F5 estate and I don't believe that the SUDO package is installed or used, but I just want to be sure.

6 REPLIES 6

DMan
Nimbostratus
Nimbostratus

F5s seems to be vulnerable, to confirm, see below:

 

How can I test if I have vulnerable version?

To test if a system is vulnerable or not, login to the system as a non-root user.

Run command “sudoedit -s /”

If the system is vulnerable, it will respond with an error that starts with “sudoedit:”

If the system is patched, it will respond with an error that starts with “usage:”

Thanks for the reply, that's interesting. My BIG-IP (15.1.04) instances return:

sudoedit: command not found

Running an rpm -qa query also doesn't show sudo being installed. Could sudo be installed on some versions and not others?

DMan
Nimbostratus
Nimbostratus

Interesting - I have tried it on v14.1.x and 15.1.2 boxes and when i type the "sudoedit -s /" getting a sudoedit: error response back.

Marcel_Vanko
Nimbostratus
Nimbostratus

I have tried it on F5 v12.1.5.2

testuser@F5v12-1-5-2:~$ sudoedit -s /
sudoedit: /: not a regular file
testuser@F5v12-1-5-2:~$ 

Test on Linux vm before and after patch

testuser@vm-not-patched:~$ sudoedit -s /
sudoedit: /: not a regular file
testuser@vm-not-patched:~$ 
 
testuser@vm-patched:~$ sudoedit -s /
usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...
testuser@vm-patched:~$

I just opened a P2 case with F5 regarding this vulnerability. They responded saying BIG-IP devices are not affected and that F5 will have a public facing KB regarding the vulnerability in the next couple of days.

Damian_Foitzik-
F5 Employee
F5 Employee