The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.

This update of sudo fixes :

  - CVE-2011-0010: Does ask for the user password for GID     changes now.

  - CVE-2010-1646: CVSS v2 Base Score: 6.6 (CWE-264): The     secure environment option can handle multiple occurrence     of PATH now.

  - CVE-2010-1163: CVSS v2 Base Score: 6.9 (CWE-20):
    Improved command matching.

From Red Hat Security Advisory 2010:0361 :

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

The RHBA-2010:0212 sudo update released as part of Red Hat Enterprise Linux 5.5 added the ability to change the value of the ignore_dot option in the '/etc/sudoers' configuration file. This ability introduced a regression in the upstream fix for CVE-2010-0426. In configurations where the ignore_dot option was set to off (the default is on for the Red Hat Enterprise Linux 5 sudo package), a local user authorized to use the sudoedit pseudo-command could possibly run arbitrary commands with the privileges of the users sudoedit was authorized to run as. (CVE-2010-1163)

Red Hat would like to thank Todd C. Miller, the upstream sudo maintainer, for responsibly reporting this issue. Upstream acknowledges Valerio Costamagna as the original reporter.

Users of sudo should upgrade to this updated package, which contains a backported patch to correct this issue.

In configurations where the ignore_dot option was set to off (the default is on for the Scientific Linux 5 sudo package), a local user authorized to use the sudoedit pseudo-command could possibly run arbitrary commands with the privileges of the users sudoedit was authorized to run as. (CVE-2010-1163)

- update to new upstream version - merged .audit and     .libaudit patch - added sudoers.ldap.5* to files -     http://sudo.ws/sudo/alerts/sudoedit_escalate2.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201006-09 (sudo: Privilege escalation)

    The command matching functionality does not properly handle when a file     in the current working directory has the same name as a pseudo-command     in the sudoers file and the PATH contains an entry for '.'.
  Impact :

    A local attacker with the permission to run sudoedit could, under     certain circumstances, execute arbitrary commands as whichever user he     has permission to run sudoedit as, typically root.
  Workaround :

    There is no known workaround at this time.

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

The RHBA-2010:0212 sudo update released as part of Red Hat Enterprise Linux 5.5 added the ability to change the value of the ignore_dot option in the '/etc/sudoers' configuration file. This ability introduced a regression in the upstream fix for CVE-2010-0426. In configurations where the ignore_dot option was set to off (the default is on for the Red Hat Enterprise Linux 5 sudo package), a local user authorized to use the sudoedit pseudo-command could possibly run arbitrary commands with the privileges of the users sudoedit was authorized to run as. (CVE-2010-1163)

Red Hat would like to thank Todd C. Miller, the upstream sudo maintainer, for responsibly reporting this issue. Upstream acknowledges Valerio Costamagna as the original reporter.

Users of sudo should upgrade to this updated package, which contains a backported patch to correct this issue.

New sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.

A vulnerability has been found and corrected in sudo :

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ., which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426 (CVE-2010-1163).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct this issue.

Update :

Packages for 2009.0 are provided due to the Extended Maintenance Program.

Todd Miller reports :

Sudo's command matching routine expects actual commands to include one or more slash ('/') characters. The flaw is that sudo's path resolution code did not add a './' prefix to commands found in the current working directory. This creates an ambiguity between a 'sudoedit' command found in the cwd and the 'sudoedit' pseudo-command in the sudoers file. As a result, a user may be able to run an arbitrary command named 'sudoedit' in the current working directory.
For the attack to be successful, the PATH environment variable must include '.' and may not include any other directory that contains a 'sudoedit' command.

ID	Name	Product	Family	Severity
75751	openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)	Nessus	SuSE Local Security Checks	medium
68033	Oracle Linux 5 : sudo (ELSA-2010-0361)	Nessus	Oracle Linux Local Security Checks	medium
60784	Scientific Linux Security Update : sudo on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53801	openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)	Nessus	SuSE Local Security Checks	medium
47449	Fedora 13 : sudo-1.7.2p6-1.fc13 (2010-6756)	Nessus	Fedora Local Security Checks	medium
46776	GLSA-201006-09 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
46756	CentOS 5 : sudo (CESA-2010:0361)	Nessus	CentOS Local Security Checks	medium
46302	RHEL 5 : sudo (RHSA-2010:0361)	Nessus	Red Hat Local Security Checks	medium
45581	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 8.1 / 9.0 / 9.1 / current : sudo (SSA:2010-110-01)	Nessus	Slackware Local Security Checks	medium
45564	Mandriva Linux Security Advisory : sudo (MDVSA-2010:078-1)	Nessus	Mandriva Local Security Checks	medium
45547	FreeBSD : sudo -- Privilege escalation with sudoedit (1a9f678d-48ca-11df-85f8-000c29a67389)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-1163

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium