SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Sudo Vendors:   Miller, Todd C.
(Vendor Issues Fix) Re: Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges
SecurityTracker Alert ID:  1004155
SecurityTracker URL:  http://securitytracker.com/id/1004155
CVE Reference:   CVE-2002-0184   (Links to External Site)
Updated:  Nov 19 2003
Original Entry Date:  Apr 25 2002
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.6.5p2 and prior
Description:   A vulnerability has been reported in the sudo utility. A local user may be able to obtain root privileges.

Global InterSec reported an off-by-five heap overflow in 'sudo'. A local user can apparently call sudo with a specially formatted argument for the -p command line option to trigger the overflow. It is reported that sudo may not correctly allocate memory when parsing the '%h' (hostname) or '%u' (username) strings in the argument in some situations. A local user could potentially trigger the overflow and execute arbitrary code with root privileges.

The exact nature of the conditions required to exploit this flaw were not provided. However, it is reported that the compile-time options and the length of the hostname may affect whether the application is vulnerable or not.

Impact:   A local user may be able to execute arbitrary code with root privileges in certain situations.
Solution:   The vendor has issued a fixed version (1.6.6), available at:

ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.6.tar.gz

A patch is also available at:

http://www.sudo.ws/pipermail/sudo-announce/2002-April/000020.html

Vendor URL:  www.courtesan.com/sudo/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Apr 25 2002 Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges



 Source Message Contents

Subject:  Sudo version 1.6.6 now available (fwd)



---------- Forwarded message ----------
Date: Thu, 25 Apr 2002 10:34:13 -0600
From: Todd C. Miller <Todd.Miller@courtesan.com>
To: sudo-announce@courtesan.com
Subject: Sudo version 1.6.6 now available

Sudo version 1.6.6 is now available (ftp sites listed at the end).

Changes since Sudo 1.6.5p2:

 o Fixed compilation problem on HP-UX 9.x.

 o Moved call to endpwent() and added a call to endgrent().

 o Fixed a warning conflicting declaration of VOID with AFS.

 o Fixed a security hole in prompt rewriting found by Global InterSec.

Please note that Sudo 1.6.6 fixes a security hole present in sudo
versions 1.5.7 - 1.6.5p2.  Please see:
    http://www.sudo.ws/pipermail/sudo-announce/2002-April/000020.html
    http://www.globalintersec.com/adv/sudo-2002041701.txt
for details.

sudo 1.6.6 distribution:
    ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.6.tar.gz

Master WWW site:
    http://www.sudo.ws/sudo/dist/

Mirrors (not yet updated)

WWW Mirrors:
    http://sudo.stikman.com/ (Los Angeles, California, USA)
    http://mirage.informationwave.net/sudo/ (Fanwood, New Jersey, USA)
    http://sudo.planetmirror.com/ (Australia)
    http://sudo.cdu.elektra.ru/ (Russia)

Master FTP sites:
    ftp.sudo.ws:/pub/sudo/
    ftp.cs.colorado.edu:/pub/sudo/

FTP Mirrors:
    ftp.cs.colorado.edu:/pub/sudo/ (Boulder, Colorado, USA)
    ftp.stikman.com:/pub/sudo/ (Los Angeles, California, USA)
    ftp.uu.net:/pub/security/sudo/ (Falls Church, Virginia, USA)
    ftp.tux.org:/pub/security/sudo/ (Beltsville, Maryland, USA)
    ftp.cerias.purdue.edu:/pub/tools/unix/sysutils/sudo/ (West Lafayette, Indiana, USA)
    ftp.uwsg.indiana.edu:/pub/sudo/ (Bloomington, Indiana, USA)
    sudobash.com:/pub/sudo/ (Ypsilanti, Michigan, USA)
    ftp.tamu.edu:/pub/mirrors/ftp.courtesan.com/ (College Station, Texas, USA)
    ftp.rge.com:/pub/admin/sudo/ (Rochester, New York, USA)
    mirage.informationwave.net:/sudo/ (Fanwood, New Jersey, USA)
    ftp.wiretapped.net:/pub/security/host-security/sudo/ (Australia)
    ftp.tuwien.ac.at:/utils/admin-tools/sudo/ (Austria)
    sunsite.ualberta.ca:/pub/Mirror/sudo/ (Alberta, Canada)
    ftp.csc.cuhk.edu.hk:/pub/packages/unix-tools/sudo/ (Hong Kong, China)
    ftp.eunet.cz:/pub/security/sudo/ (Czechoslovakia)
    ftp.umds.ac.uk:/pub/sudo/ (Great Britain)
    ftp.tvi.tut.fi:/pub/security/unix/sudo/ (Finland)
    ftp.lps.ens.fr:/pub/software/sudo/ (France)
    ftp.crihan.fr:/pub/security/sudo/ (France)
    ftp.rz.uni-osnabrueck.de:/pub/unix/security/sudo/ (Germany)
    ftp.win.ne.jp:/pub/misc/sudo/ (Japan)
    ftp.st.ryukoku.ac.jp:/pub/security/tool/sudo/ (Japan)
    ftp.eos.hokudai.ac.jp:/pub/misc/sudo/ (Japan)
    ftp.tokyonet.ad.jp:/pub/security/sudo/ (Japan)
    ftp.kobe-u.ac.jp:/pub/util/security/tool/sudo/ (Japan)
    ftp.cin.nihon-u.ac.jp:/pub/util/sudo/ (Japan)
    ftp.fujitsu.co.jp:/pub/misc/sudo/ (Japan)
    core.ring.gr.jp:/pub/misc/sudo/ (Japan)
    ftp.ring.gr.jp:/pub/misc/sudo/ (Japan)
    ftp.ayamura.org:/pub/sudo/ (Japan)
    ftp.iphil.net:/pub/sudo/ (Makati City, Philippines)
    ftp.icm.edu.pl:/vol/wojsyl5/sudo/ (Poland)
    ftp.assist.ro:/pub/mirrors/ftp.courtesan.com/pub/sudo/ (Romania)
    ftp.sai.msu.su:/pub/unix/security/ (Russia)
    ftp.cdu.elektra.ru:/pub/unix/security/sudo/ (Russia)
    ftp.mc.hik.se:/pub/unix/security/sudo/ (Sweden)
    ftp.sekure.net:/pub/sudo/ (Sweden)
    ftp.edu.tw:/UNIX/sudo/ (Taiwan)
    ftp.comu.edu.tr:/pub/linux/prog/sudo/ (Turkey)
____________________________________________________________
sudo-announce mailing list <sudo-announce@sudo.ws>
For list information, options, or to unsubscribe, visit:
http://www.sudo.ws/mailman/listinfo/sudo-announce

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC