Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that have the same name as library files that are included by the script.

Previous sudo updates were made available to sanitize certain environment variables from affecting a sudo call, such as PYTHONINSPECT, PERL5OPT, etc. While those updates were effective in addressing those specific environment variables, other variables that were not blacklisted were being made available.

Debian addressed this issue by forcing sudo to use a whitlist approach in DSA-946-2 by arbitrarily making env_reset the default (as opposed to having to be enabled in /etc/sudoers). Mandriva has opted to follow the same approach so now only certain variables are, by default, made available, such as HOME, LOGNAME, SHELL, TERM, DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER, as well as the SUDO_* variables.

If other variables are required to be kept, this can be done by editing /etc/sudoers and using the env_keep option, such as :

Defaults env_keep='FOO BAR'

As well, the Corporate 3 packages are now compiled with the SECURE_PATH setting.

Updated packages are patched to address this issue.

The former correction to vulnerabilities in the sudo package worked fine but were too strict for some environments. Therefore we have reviewed the changes again and allowed some environment variables to go back into the privileged execution environment. Hence, this update.

The configuration option 'env_reset' is now activated by default. It will preserve only the environment variables HOME, LOGNAME, PATH, SHELL, TERM, DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER in addition to the separate SUDO_* variables.

For completeness please find below the original advisory text :

  It has been discovered that sudo, a privileged program, that   provides limited super user privileges to specific users, passes   several environment variables to the program that runs with elevated   privileges. In the case of include paths (e.g. for Perl, Python,   Ruby or other scripting languages) this can cause arbitrary code to   be executed as privileged user if the attacker points to a   manipulated version of a system library.

  This update alters the former behaviour of sudo and limits the   number of supported environment variables to LC_*, LANG, LANGUAGE   and TERM. Additional variables are only passed through when set as   env_check in /etc/sudoers, which might be required for some scripts   to continue to work.

USN-235-1 fixed a vulnerability in sudo's handling of environment variables. Tavis Ormandy noticed that sudo did not filter out the PYTHONINSPECT environment variable, so that users with the limited privilege of calling a python script with sudo could still escalate their privileges.

For reference, this is the original advisory :

Charles Morris discovered a privilege escalation vulnerability in sudo. On executing Perl scripts with sudo, various environment variables that affect Perl's library search path were not cleaned properly. If sudo is set up to grant limited sudo execution of Perl scripts to normal users, this could be exploited to run arbitrary commands as the target user.

This security update also filters out environment variables that can be exploited similarly with Python, Ruby, and zsh scripts.

Please note that this does not affect the default Ubuntu installation, or any setup that just grants full root privileges to certain users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Charles Morris discovered a privilege escalation vulnerability in sudo. On executing Perl scripts with sudo, various environment variables that affect Perl's library search path were not cleaned properly. If sudo is set up to grant limited sudo execution of Perl scripts to normal users, this could be exploited to run arbitrary commands as the target user.

This security update also filters out environment variables that can be exploited similarly with Python, Ruby, and zsh scripts.

Please note that this does not affect the default Ubuntu installation, or any setup that just grants full root privileges to certain users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Charles Morris discovered a vulnerability in sudo versions prior to 1.6.8p12 where, when the perl taint flag is off, sudo does not clear the PERLLIB, PERL5LIB, and PERL5OPT environment variables, which could allow limited local users to cause a perl script to include and execute arbitrary library files that have the same name as library files that included by the script.

In addition, other environment variables have been included in the patch that remove similar environment variables that could be used in python and ruby, scripts, among others.

The updated packages have been patched to correct this problem.

ID	Name	Product	Family	Severity
23903	Mandrake Linux Security Advisory : sudo (MDKSA-2006:159)	Nessus	Mandriva Local Security Checks	high
22812	Debian DSA-946-2 : sudo - missing input sanitising	Nessus	Debian Local Security Checks	high
20780	Ubuntu 4.10 / 5.04 / 5.10 : sudo vulnerability (USN-235-2)	Nessus	Ubuntu Local Security Checks	medium
20779	Ubuntu 4.10 / 5.04 / 5.10 : sudo vulnerability (USN-235-1)	Nessus	Ubuntu Local Security Checks	medium
20465	Mandrake Linux Security Advisory : sudo (MDKSA-2005:234)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2005-4158

high

Tenable Plugins

high

high

medium

medium

high