The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Berkeley DB NSS module
  - cURL / libcURL
  - GnuTLS
  - Network Security Services (NSS) Library
  - OpenLDAP
  - OpenSSL
  - OpenSSL Kerberos
  - sudo

This update of sudo fixes :

  - CVE-2011-0010: Does ask for the user password for GID     changes now.

  - CVE-2010-1646: CVSS v2 Base Score: 6.6 (CWE-264): The     secure environment option can handle multiple occurrence     of PATH now.

  - CVE-2010-1163: CVSS v2 Base Score: 6.9 (CWE-20):
    Improved command matching.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2010-0475 advisory.

    [1.7.2p1-7]
    - added patch that fixes insufficient environment sanitization issue (#598154)       Resolves: #598381

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way sudo handled the presence of duplicated environment variables. A local user authorized to run commands using sudo could use this flaw to set additional values for the environment variables set by sudo, which could result in those values being used by the executed command instead of the values set by sudo. This could possibly lead to certain intended restrictions being bypassed, such as the secure_path setting. (CVE-2010-1646)

a. Service Console update for NSS_db

   The service console package NSS_db is updated to version    nss_db-2.2-35.4.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0826 to this issue.

b. Service Console update for OpenLDAP

   The service console package OpenLDAP updated to version    2.3.43-12.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-3767 to this issue.

c. Service Console update for cURL

   The service console packages for cURL updated to version    7.15.5-9.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to this issue.

d. Service Console update for sudo

   The service console package sudo updated to version 1.7.2p1-7.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1646 to this issue.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

   Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2    and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8,    and NSS to version 3.12.6-1.3235.vmw and NSPR to version    4.8.4-1.3235.vmw. These four updates are bundled together due to    their mutual dependencies.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245    and CVE-2010-0433 to the issues addressed in this update.

The remote host is affected by the vulnerability described in GLSA-201009-03 (sudo: Privilege Escalation)

    Multiple vulnerabilities have been reported in sudo:
    Evan     Broder and Anders Kaseorg of Ksplice, Inc. reported that the sudo     'secure path' feature does not properly handle multiple PATH variables     (CVE-2010-1646).
    Markus Wuethrich of Swiss Post reported that     sudo fails to restrict access when using Runas groups and the group     (-g) command line option (CVE-2010-2956).
  Impact :

    A local attacker could exploit these vulnerabilities to gain the     ability to run certain commands with the privileges of other users,     including root, depending on the configuration.
  Workaround :

    There is no known workaround at this time.

Evan Broder and Anders Kaseorg discovered that sudo did not properly sanitize its environment when configured to use secure_path (the default in Ubuntu). A local attacker could exploit this to execute arbitrary code as root if sudo was configured to allow the attacker to use a program that interpreted the PATH environment variable.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- added patch that fixes insufficient environment     sanitization issue (CVE-2010-1646)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Anders Kaseorg and Evan Broder discovered a vulnerability in sudo, a program designed to allow a sysadmin to give limited root privileges to users, that allows a user with sudo permissions on certain programs to use those programs with an untrusted value of PATH. This could possibly lead to certain intended restrictions being bypassed, such as the secure_path setting.

A vulnerability has been discovered and corrected in sudo :

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable (CVE-2010-1646).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled the presence of duplicated environment variables. A local user authorized to run commands using sudo could use this flaw to set additional values for the environment variables set by sudo, which could result in those values being used by the executed command instead of the values set by sudo. This could possibly lead to certain intended restrictions being bypassed, such as the secure_path setting. (CVE-2010-1646)

Red Hat would like to thank Anders Kaseorg and Evan Broder of Ksplice, Inc. for responsibly reporting this issue.

Users of sudo should upgrade to this updated package, which contains a backported patch to correct this issue.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2010:0475 advisory.

    The sudo (superuser do) utility allows system administrators to give     certain users the ability to run commands as root.

    A flaw was found in the way sudo handled the presence of duplicated     environment variables. A local user authorized to run commands using sudo     could use this flaw to set additional values for the environment variables     set by sudo, which could result in those values being used by the executed     command instead of the values set by sudo. This could possibly lead to     certain intended restrictions being bypassed, such as the secure_path     setting. (CVE-2010-1646)

    Red Hat would like to thank Anders Kaseorg and Evan Broder of Ksplice, Inc.
    for responsibly reporting this issue.

    Users of sudo should upgrade to this updated package, which contains a     backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Todd Miller reports :

Most versions of the C library function getenv() return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell (bash), do their own environment parsing and may choose the last instance of a variable rather than the first one.

An attacker may manipulate the environment of the process that executes Sudo such that a second PATH variable is present. When Sudo runs a bash script, it is this second PATH variable that is used by bash, regardless of whether or not Sudo has overwritten the first instance of PATH. This may allow an attacker to subvert the program being run under Sudo and execute commands he/she would not otherwise be allowed to run.

ID	Name	Product	Family	Severity
89742	VMware ESX Multiple Vulnerabilities (VMSA-2010-0015) (remote check)	Nessus	VMware ESX Local Security Checks	critical
75751	openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)	Nessus	SuSE Local Security Checks	medium
68050	Oracle Linux 5 : sudo (ELSA-2010-0475)	Nessus	Oracle Linux Local Security Checks	high
60803	Scientific Linux Security Update : sudo on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53801	openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)	Nessus	SuSE Local Security Checks	medium
49703	VMSA-2010-0015 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	critical
49124	GLSA-201009-03 : sudo: Privilege Escalation	Nessus	Gentoo Local Security Checks	medium
47575	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : sudo vulnerability (USN-956-1)	Nessus	Ubuntu Local Security Checks	medium
47533	Fedora 11 : sudo-1.7.2p6-2.fc11 (2010-9417)	Nessus	Fedora Local Security Checks	medium
47532	Fedora 12 : sudo-1.7.2p6-2.fc12 (2010-9415)	Nessus	Fedora Local Security Checks	medium
47531	Fedora 13 : sudo-1.7.2p6-2.fc13 (2010-9402)	Nessus	Fedora Local Security Checks	medium
47104	Debian DSA-2062-1 : sudo - missing input sanitization	Nessus	Debian Local Security Checks	medium
47041	Mandriva Linux Security Advisory : sudo (MDVSA-2010:118)	Nessus	Mandriva Local Security Checks	medium
47032	CentOS 5 : sudo (CESA-2010:0475)	Nessus	CentOS Local Security Checks	medium
47027	RHEL 5 : sudo (RHSA-2010:0475)	Nessus	Red Hat Local Security Checks	high
46792	FreeBSD : sudo -- Secure path vulnerability (d42e5b66-6ea0-11df-9c8d-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-1646

high

Tenable Plugins

critical

medium

high

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

high

medium