parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in sudo in file parse.c due to a failure     to properly interpret a system group (%group) in the     sudoers configuration file when handling authorization     decisions for users belonging to that group. A local     attacker can exploit this to gain root privileges via a     crafted sudo command. (CVE-2009-0034)

  - A flaw exists in the redirect implementation in libcurl     that allows arbitrary Location values to be accepted     when CURLOPT_FOLLOWLOCATION is enabled. An attacker     with control of a remote HTTP server can exploit this,     via crafted redirect URLs, to trigger requests to     intranet servers, to read or write arbitrary files, or     to execute arbitrary commands. (CVE-2009-0037)

  - A flaw exists in udev due to a failure to verify that a     NETLINK message originates from the kernel space. A     local attacker can exploit this, via a crafted NETLINK     message, to gain elevated privileges on the root file     system. (CVE-2009-1185)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-0267 advisory.

    [1.6.9p17-3.el5_3.1]
    - audit patch rediff (one chunk failed to apply due to fuzz=0)
    - Fix for incorrect handling of groups in Runas_User (#481720)       Resolves: #481820

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was discovered in a way sudo handled group specifications in 'run as' lists in the sudoers configuration file. If sudo configuration allowed a user to run commands as any user of some group and the user was also a member of that group, sudo incorrectly allowed them to run defined commands with the privileges of any system user.
This gave the user unintended privileges. (CVE-2009-0034)

a. Service Console package udev

   A vulnerability in the udev program did not verify whether a NETLINK    message originates from kernel space, which allows local users to    gain privileges by sending a NETLINK message from user space.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1185 to this issue.

   Please see http://kb.vmware.com/kb/1011786 for details.

b. Service Console package sudo

   Service Console package for sudo has been updated to version    sudo-1.6.9p17-3. This fixes the following issue: Sudo versions    1.6.9p17 through 1.6.9p19 do not properly interpret a system group    in the sudoers file during authorization decisions for a user who    belongs to that group, which might allow local users to leverage an    applicable sudoers file and gain root privileges by using a sudo    command.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0034 to this issue.

   Please see http://kb.vmware.com/kb/1011781 for more details

c. Service Console package curl

   Service Console package for curl has been updated to version    curl-7.15.5-2.1.  This fixes the following issue: The redirect    implementation in curl and libcurl 5.11 through 7.19.3, when    CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location    values, which might allow remote HTTP servers to trigger arbitrary    requests to intranet servers, read or overwrite arbitrary files by    using a redirect to a file: URL, or execute arbitrary commands by    using a redirect to an scp: URL.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0037 to this issue.

   Please see http://kb.vmware.com/kb/1011782 for details

- rebase to 1.7.4p5

    - fixed sudo-1.7.4p4-getgrouplist.patch

    - fixes CVE-2011-0008, CVE-2011-0010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been identified in sudo which allowed - depending on the sudoers rules - a sudo-user to execute arbitrary shell commands as root (CVE-2009-0034).

The updated packages have been patched to prevent this.

Harald Koenig discovered that sudo did not correctly handle certain privilege changes when handling groups. If a local attacker belonged to a group included in a 'RunAs' list in the /etc/sudoers file, that user could gain root privileges. This was not an issue for the default sudoers file shipped with Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for incorrect handling of groups in Runas_User

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200902-01 (sudo: Privilege escalation)

    Harald Koenig discovered that sudo incorrectly handles group     specifications in Runas_Alias (and related) entries when a group is     specified in the list (using %group syntax, to allow a user to run     commands as any member of that group) and the user is already a member     of that group.
  Impact :

    A local attacker could possibly run commands as an arbitrary system     user (including root).
  Workaround :

    There is no known workaround at this time.

Todd Miller reports :

A bug was introduced in Sudo's group matching code in version 1.6.9 when support for matching based on the supplemental group vector was added. This bug may allow certain users listed in the sudoers file to run a command as a different user than their access rule specifies.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:0267 advisory.

    The sudo (superuser do) utility allows system administrators to give     certain users the ability to run commands as root with logging.

    A flaw was discovered in a way sudo handled group specifications in run     as lists in the sudoers configuration file. If sudo configuration allowed     a user to run commands as any user of some group and the user was also a     member of that group, sudo incorrectly allowed them to run defined commands     with the privileges of any system user. This gave the user unintended     privileges. (CVE-2009-0034)

    Users of sudo should update to this updated package, which contains a     backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
89115	VMware ESX Multiple Vulnerabilities (VMSA-2009-0009) (remote check)	Nessus	Misc.	high
67801	Oracle Linux 5 : sudo (ELSA-2009-0267)	Nessus	Oracle Linux Local Security Checks	high
60529	Scientific Linux Security Update : sudo on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
52011	VMSA-2009-0009 : ESX Service Console updates for udev, sudo, and curl	Nessus	VMware ESX Local Security Checks	high
51656	Fedora 13 : sudo-1.7.4p5-1.fc13 (2011-0455)	Nessus	Fedora Local Security Checks	medium
51566	Fedora 14 : sudo-1.7.4p5-1.fc14 (2011-0470)	Nessus	Fedora Local Security Checks	medium
38137	Mandriva Linux Security Advisory : sudo (MDVSA-2009:033)	Nessus	Mandriva Local Security Checks	medium
38070	Ubuntu 8.04 LTS / 8.10 : sudo vulnerability (USN-722-1)	Nessus	Ubuntu Local Security Checks	medium
36971	Fedora 10 : sudo-1.6.9p17-5.fc10 (2009-1074)	Nessus	Fedora Local Security Checks	medium
35614	GLSA-200902-01 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
35613	FreeBSD : sudo -- certain authorized users could run commands as any user (13d6d997-f455-11dd-8516-001b77d09812)	Nessus	FreeBSD Local Security Checks	medium
35605	RHEL 5 : sudo (RHSA-2009:0267)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2009-0034

high

Tenable Plugins

high

high

medium

high

medium

medium

medium

medium

medium

medium

medium

high