Overview
Sudo is susceptible to a locally exploitable heap overflow vulnerability.
Description
Sudo is a common utility used to allow a system administrator to give users or groups of users rights to run certain programs as root or as another user. A locally exploitable heap overflow can lead to the execution of arbitrary code by a local attacker. |
Impact
A local attacker can execute arbitrary code as root. |
Solution
Apply a patch from your vendor. |
Vendor Information
Courtesan Affected
Updated: April 26, 2002
Status
Affected
Vendor Statement
Date: Thu, 25 Apr 2002 10:34:13 -0600
From: Todd C. Miller <Todd.Miller@courtesan.com>
To: sudo-announce@courtesan.com
Subject: Sudo version 1.6.6 now available
Sudo version 1.6.6 is now available (ftp sites listed at the end).
Changes since Sudo 1.6.5p2:
o Fixed compilation problem on HP-UX 9.x.
o Moved call to endpwent() and added a call to endgrent().
o Fixed a warning conflicting declaration of VOID with AFS.
o Fixed a security hole in prompt rewriting found by Global InterSec.
Please note that Sudo 1.6.6 fixes a security hole present in sudo
versions 1.5.7 - 1.6.5p2. Please see:
http://www.sudo.ws/pipermail/sudo-announce/2002-April/000020.html
http://www.globalintersec.com/adv/sudo-2002041701.txt
for details.
sudo 1.6.6 distribution:
ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.6.tar.gz
Master WWW site:
http://www.sudo.ws/sudo/dist/
Mirrors (not yet updated)
WWW Mirrors:
http://sudo.stikman.com/ (Los Angeles, California, USA)
http://mirage.informationwave.net/sudo/ (Fanwood, New Jersey, USA)
http://sudo.planetmirror.com/ (Australia)
http://sudo.cdu.elektra.ru/ (Russia)
Master FTP sites:
ftp.sudo.ws:/pub/sudo/
ftp.cs.colorado.edu:/pub/sudo/
FTP Mirrors:
ftp.cs.colorado.edu:/pub/sudo/ (Boulder, Colorado, USA)
ftp.stikman.com:/pub/sudo/ (Los Angeles, California, USA)
ftp.uu.net:/pub/security/sudo/ (Falls Church, Virginia, USA)
ftp.tux.org:/pub/security/sudo/ (Beltsville, Maryland, USA)
ftp.cerias.purdue.edu:/pub/tools/unix/sysutils/sudo/ (West Lafayette, Indiana, USA)
ftp.uwsg.indiana.edu:/pub/sudo/ (Bloomington, Indiana, USA)
sudobash.com:/pub/sudo/ (Ypsilanti, Michigan, USA)
ftp.tamu.edu:/pub/mirrors/ftp.courtesan.com/ (College Station, Texas, USA)
ftp.rge.com:/pub/admin/sudo/ (Rochester, New York, USA)
mirage.informationwave.net:/sudo/ (Fanwood, New Jersey, USA)
ftp.wiretapped.net:/pub/security/host-security/sudo/ (Australia)
ftp.tuwien.ac.at:/utils/admin-tools/sudo/ (Austria)
sunsite.ualberta.ca:/pub/Mirror/sudo/ (Alberta, Canada)
ftp.csc.cuhk.edu.hk:/pub/packages/unix-tools/sudo/ (Hong Kong, China)
ftp.eunet.cz:/pub/security/sudo/ (Czechoslovakia)
ftp.umds.ac.uk:/pub/sudo/ (Great Britain)
ftp.tvi.tut.fi:/pub/security/unix/sudo/ (Finland)
ftp.lps.ens.fr:/pub/software/sudo/ (France)
ftp.crihan.fr:/pub/security/sudo/ (France)
ftp.rz.uni-osnabrueck.de:/pub/unix/security/sudo/ (Germany)
ftp.win.ne.jp:/pub/misc/sudo/ (Japan)
ftp.st.ryukoku.ac.jp:/pub/security/tool/sudo/ (Japan)
ftp.eos.hokudai.ac.jp:/pub/misc/sudo/ (Japan)
ftp.tokyonet.ad.jp:/pub/security/sudo/ (Japan)
ftp.kobe-u.ac.jp:/pub/util/security/tool/sudo/ (Japan)
ftp.cin.nihon-u.ac.jp:/pub/util/sudo/ (Japan)
ftp.fujitsu.co.jp:/pub/misc/sudo/ (Japan)
core.ring.gr.jp:/pub/misc/sudo/ (Japan)
ftp.ring.gr.jp:/pub/misc/sudo/ (Japan)
ftp.ayamura.org:/pub/sudo/ (Japan)
ftp.iphil.net:/pub/sudo/ (Makati City, Philippines)
ftp.icm.edu.pl:/vol/wojsyl5/sudo/ (Poland)
ftp.assist.ro:/pub/mirrors/ftp.courtesan.com/pub/sudo/ (Romania)
ftp.sai.msu.su:/pub/unix/security/ (Russia)
ftp.cdu.elektra.ru:/pub/unix/security/sudo/ (Russia)
ftp.mc.hik.se:/pub/unix/security/sudo/ (Sweden)
ftp.sekure.net:/pub/sudo/ (Sweden)
ftp.edu.tw:/UNIX/sudo/ (Taiwan)
ftp.comu.edu.tr:/pub/linux/prog/sudo/ (Turkey)
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Debian Affected
Updated: April 26, 2002
Status
Affected
Vendor Statement
-----BEGIN PGP SIGNED MESSAGE-----
- ------------------------------------------------------------------------
Debian Security Advisory DSA-128-1 security@debian.org
http://www.debian.org/security/ Wichert Akkerman
April 26, 2002
- ------------------------------------------------------------------------
Package : sudo
Problem type : buffer overflow
Debian-specific: no
fc found a buffer overflow in the variable expansion code
used by sudo for its prompt. Since sudo is necessarily installed suid
root a local user can use this to gain root access.
This has been fixed in version 1.6.2-2.2 and we recommend that you upgrade
your sudo package immediately.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.2 alias potato
- ---------------------------------
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
Source archives:
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.diff.gz
MD5 checksum: 958560c409b43bd13463b3d380fc534a
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.dsc
MD5 checksum: 7323f0f3614513156120ccc4772524f8
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2.orig.tar.gz
MD5 checksum: dd5944c880fd5cc56bc0f0199e92d2b4
Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/sudo_1.6.2p2-2.2_alpha.deb
MD5 checksum: 66cb0d4f730560fddba65e44dd78c34d
ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/sudo_1.6.2p2-2.2_arm.deb
MD5 checksum: f74bae46ebd07bd8f430261153d13f90
Intel IA-32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/sudo_1.6.2p2-2.2_i386.deb
MD5 checksum: 9ac9b91818dd7b2f2888aa39aac0da98
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/sudo_1.6.2p2-2.2_m68k.deb
MD5 checksum: 46f6d595363d23c96701cd303511e1a5
PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/sudo_1.6.2p2-2.2_powerpc.deb
MD5 checksum: 66c23d2544e9a8f19c57c919a4a751c9
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/sudo_1.6.2p2-2.2_sparc.deb
MD5 checksum: 9654ecac0230abe0f28524469fb5887e
These packages will be moved into the stable distribution on its next
revision.
- --
- ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQB1AwUBPMiNiqjZR/ntlUftAQErEwL/Xi3i/N5tGqezLTsuJlgChy6MLnX7gJG4
cMa5MzW+1xUH39xz6JAgPKQv9C4FyPqgEOOwa5xt/0vkNasj8ARiu/avLM4Uk6uS
22t9YWRjlnP4tPIi4DPhv20LFu1jeSNH
=0Rd2
-----END PGP SIGNATURE-----
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
MandrakeSoft Affected
Updated: April 26, 2002
Status
Affected
Vendor Statement
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
Mandrake Linux Security Update Advisory
________________________________________________________________________
Package name: sudo
Advisory ID: MDKSA-2002:028
Date: April 25th, 2002
Affected versions: 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1
Single Network Firewall 7.2
________________________________________________________________________
Problem Description:
A problem was discovered by fc, with further research by Global
InterSec, in the sudo program with the password prompt parameter
(-p). Sudo can be tricked into allocating less memory than it should
for the prompt and in certain conditions it is possible to exploit this
flaw to corrupt the heap in such a way that could be used to execute
arbitary commands. Because sudo is generally suid root, this can lead
to an elevation of privilege for local users.
________________________________________________________________________
References:
http://www.globalintersec.com/adv/sudo-2002041701.txt
________________________________________________________________________
Updated Packages:
Linux-Mandrake 7.1:
2214bb7c879f0c34425d379795a447ee 7.1/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 7.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Linux-Mandrake 7.2:
53cd161682fc5ec047bbab190037e7cb 7.2/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 7.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Mandrake Linux 8.0:
a35538cd7efe7c9a34a6dc81b767e3ea 8.0/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 8.0/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Mandrake Linux 8.0/ppc:
867b935b9e39afaca5535c25673f2860 ppc/8.0/RPMS/sudo-1.6.4-3.1mdk.ppc.rpm
552ef456ff9fd4028bd8371b808adae6 ppc/8.0/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Mandrake Linux 8.1:
d6cccdaaca2a338bcd75290bef1c3440 8.1/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 8.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Mandrake Linux 8.1/ia64:
80e0441fe8ebdd804adbe0fb3127c950 ia64/8.1/RPMS/sudo-1.6.4-3.1mdk.ia64.rpm
552ef456ff9fd4028bd8371b808adae6 ia64/8.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Mandrake Linux 8.2:
752d02e218508c12a3d4500e3c8fe842 8.2/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 8.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Mandrake Linux 8.2/ppc:
fa9ee180fdf44ed92f9c27ee96096471 ppc/8.2/RPMS/sudo-1.6.4-3.1mdk.ppc.rpm
552ef456ff9fd4028bd8371b808adae6 ppc/8.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Corporate Server 1.0.1:
2214bb7c879f0c34425d379795a447ee 1.0.1/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 1.0.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
Single Network Firewall 7.2:
53cd161682fc5ec047bbab190037e7cb snf7.2/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 snf7.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm
________________________________________________________________________
Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
________________________________________________________________________
To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you.
If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from:
http://www.mandrakesecure.net/en/ftp.php
Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:
rpm --checksig <filename>
All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team from:
https://www.mandrakesecure.net/RPM-GPG-KEYS
Please be aware that sometimes it takes the mirrors a few hours to
update.
You can view other update advisories for Mandrake Linux at:
http://www.mandrakesecure.net/en/advisories/
MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
visiting:
http://www.mandrakesecure.net/en/mlist.php
If you want to report vulnerabilities, please contact
security@linux-mandrake.com
________________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security@linux-mandrake.com>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see http://www.gnupg.org
mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE8yIIRmqjQ0CJFipgRAll1AKDQ6YU3mIdSta4vgeMkfWt0bwGDvACgq9Z6
lstFqr1DdYlIcookM8CC+jo=
=QMdk
-----END PGP SIGNATURE-----
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Red Hat Affected
Updated: April 26, 2002
Status
Affected
Vendor Statement
Please see http://www.redhat.com/mailing-lists/redhat-watch-list/msg00365.html.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Slackware Affected
Updated: April 26, 2002
Status
Affected
Vendor Statement
New sudo packages are available to fix a security problem which may allow
users to become root, or to execute arbitrary code as root.
Here's the information from the Slackware 8.0 ChangeLog:
----------------------------
Thu Apr 25 12:00:50 PDT 2002
patches/packages/sudo.tgz: Upgraded to sudo-1.6.6.
This version of sudo fixes a security problem whereby a local user may gain
root access through corruption of the heap (Off-By-Five).
This issue was discovered by Global InterSec LLC, and more information may
be found on their web site:
http://www.globalintersec.com/adv/sudo-2002041701.txt
The discussion on the site indicates that this problem may only be exploitable
on systems that use PAM, which Slackware does not use. However, in the
absence of proof, it still seems prudent to upgrade sudo immediately.
(* Security fix *)
----------------------------
WHERE TO FIND THE NEW PACKAGES:
-------------------------------
Updated sudo package for Slackware 7.1:
ftp://ftp.slackware.com/pub/slackware/slackware-7.1/patches/packages/sudo.tgz
Updated sudo package for Slackware 8.0:
ftp://ftp.slackware.com/pub/slackware/slackware-8.0/patches/packages/sudo.tgz
Updated sudo package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/sudo-1.6.6-i386-1.tgz
MD5 SIGNATURE:
--------------
Here is the md5sum for the package:
Slackware 7.1:
1f2eb2c0e01c5d2182431cc401f78a89 sudo.tgz
Slackware 8.0:
d0598233fefeb9d37450eec10a087e07 sudo.tgz
Slackware -current:
26c70a9a740823353300b23f110b3cca sudo-1.6.6-i386-1.tgz
INSTALLATION INSTRUCTIONS:
--------------------------
As root, upgrade to the new sudo.tgz package:
# upgradepkg sudo.tgz
Remember, it's also a good idea to backup configuration files before
upgrading packages.
- Slackware Linux Security Team
http://www.slackware.com
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This document was written by Ian A. Finlay.
Other Information
| CVE IDs: | CVE-2002-0184 |
| Severity Metric: | 15.75 |
| Date Public: | 2002-04-25 |
| Date First Published: | 2002-04-26 |
| Date Last Updated: | 2002-04-26 17:27 UTC |
| Document Revision: | 13 |