Stack-based buffer overflow in the audit_log_user_command function in lib/audit_logging.c in Linux Audit before 1.7 might allow remote attackers to execute arbitrary code via a long command argument. NOTE: some of these details are obtained from third party information.

Joe Nall reported a stack-based buffer overflow in Audit's log handling that could allow remote attackers to execute arbitrary code via a long command argument (CVE-2008-1628).

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200807-14 (Linux Audit: Buffer overflow)

    A stack-based buffer overflow has been reported in the     audit_log_user_command() function in the file lib/audit_logging.c when     processing overly long arguments.
  Impact :

    A local attacker could execute a specially crafted command on the host     running Linux Audit, possibly resulting in the execution of arbitrary     code with the privileges of the user running Linux Audit.
  Workaround :

    There is no known workaround at this time.

A bug in the audit_log_user_command() function could lead to a buffer overflow. No program in openSUSE uses that function. Third-party applications could be affected though (CVE-2008-1628).

This release fixes the init script headers to not provide LSB info.
This was causing audit to start too late. It also fixes a problem where saddr fields were not being decoded correctly on avc events in ausearch. This also fixes a buffer overflow in audit_log_user_command that is caught by FORTIFY_SOURCE, resulting in an application crash.
sudo is the only application known to use this vulnerable function.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
37139	Mandriva Linux Security Advisory : audit (MDVSA-2008:083)	Nessus	Mandriva Local Security Checks	medium
33780	GLSA-200807-14 : Linux Audit: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
32076	openSUSE 10 Security Update : audit (audit-5212)	Nessus	SuSE Local Security Checks	medium
31825	Fedora 8 : audit-1.6.8-4.fc8 (2008-3012)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1628

critical

Tenable Plugins

medium

medium

medium

medium