SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Sudo Vendors:   Miller, Todd C.
(Debian Issues Fix) Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges
SecurityTracker Alert ID:  1004158
SecurityTracker URL:  http://securitytracker.com/id/1004158
CVE Reference:   CVE-2002-0184   (Links to External Site)
Updated:  Nov 19 2003
Original Entry Date:  Apr 26 2002
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.6.5p2 and prior
Description:   A vulnerability has been reported in the sudo utility. A local user may be able to obtain root privileges.

Global InterSec reported an off-by-five heap overflow in 'sudo'. A local user can apparently call sudo with a specially formatted argument for the -p command line option to trigger the overflow. It is reported that sudo may not correctly allocate memory when parsing the '%h' (hostname) or '%u' (username) strings in the argument in some situations. A local user could potentially trigger the overflow and execute arbitrary code with root privileges.

The exact nature of the conditions required to exploit this flaw were not provided. However, it is reported that the compile-time options and the length of the hostname may affect whether the application is vulnerable or not.

Impact:   A local user may be able to execute arbitrary code with root privileges in certain situations.
Solution:   The vendor has released a fix (1.6.2-2.2) for Debian GNU/Linux 2.2 alias potato:

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

Source archives:
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.diff.gz
MD5 checksum: 958560c409b43bd13463b3d380fc534a
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.dsc
MD5 checksum: 7323f0f3614513156120ccc4772524f8
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2.orig.tar.gz
MD5 checksum: dd5944c880fd5cc56bc0f0199e92d2b4

Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/sudo_1.6.2p2-2.2_alpha.deb
MD5 checksum: 66cb0d4f730560fddba65e44dd78c34d

ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/sudo_1.6.2p2-2.2_arm.deb
MD5 checksum: f74bae46ebd07bd8f430261153d13f90

Intel IA-32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/sudo_1.6.2p2-2.2_i386.deb
MD5 checksum: 9ac9b91818dd7b2f2888aa39aac0da98

Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/sudo_1.6.2p2-2.2_m68k.deb
MD5 checksum: 46f6d595363d23c96701cd303511e1a5

PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/sudo_1.6.2p2-2.2_powerpc.deb
MD5 checksum: 66c23d2544e9a8f19c57c919a4a751c9

Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/sudo_1.6.2p2-2.2_sparc.deb
MD5 checksum: 9654ecac0230abe0f28524469fb5887e

These packages will be moved into the stable distribution on its next revision.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

Vendor URL:  www.courtesan.com/sudo/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Debian)

Message History:   This archive entry is a follow-up to the message listed below.
Apr 25 2002 Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges



 Source Message Contents

Subject:  [SECURITY] [DSA-128-1] sudo buffer overflow


-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory DSA-128-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
April 26, 2002
- ------------------------------------------------------------------------


Package        : sudo
Problem type   : buffer overflow
Debian-specific: no

fc found a buffer overflow in the variable expansion code
used by sudo for its prompt. Since sudo is necessarily installed suid
root a local user can use this to gain root access.

This has been fixed in version 1.6.2-2.2 and we recommend that you upgrade
your sudo package immediately.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

  Source archives:
    http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.diff.gz
      MD5 checksum: 958560c409b43bd13463b3d380fc534a
    http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.dsc
      MD5 checksum: 7323f0f3614513156120ccc4772524f8
    http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2.orig.tar.gz
      MD5 checksum: dd5944c880fd5cc56bc0f0199e92d2b4

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/main/binary-alpha/sudo_1.6.2p2-2.2_alpha.deb
      MD5 checksum: 66cb0d4f730560fddba65e44dd78c34d

  ARM architecture:
    http://security.debian.org/dists/stable/updates/main/binary-arm/sudo_1.6.2p2-2.2_arm.deb
      MD5 checksum: f74bae46ebd07bd8f430261153d13f90

  Intel IA-32 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-i386/sudo_1.6.2p2-2.2_i386.deb
      MD5 checksum: 9ac9b91818dd7b2f2888aa39aac0da98

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-m68k/sudo_1.6.2p2-2.2_m68k.deb
      MD5 checksum: 46f6d595363d23c96701cd303511e1a5

  PowerPC architecture:
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/sudo_1.6.2p2-2.2_powerpc.deb
      MD5 checksum: 66c23d2544e9a8f19c57c919a4a751c9

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/main/binary-sparc/sudo_1.6.2p2-2.2_sparc.deb
      MD5 checksum: 9654ecac0230abe0f28524469fb5887e

  These packages will be moved into the stable distribution on its next
  revision.

- -- 
- ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBPMiNiqjZR/ntlUftAQErEwL/Xi3i/N5tGqezLTsuJlgChy6MLnX7gJG4
cMa5MzW+1xUH39xz6JAgPKQv9C4FyPqgEOOwa5xt/0vkNasj8ARiu/avLM4Uk6uS
22t9YWRjlnP4tPIi4DPhv20LFu1jeSNH
=0Rd2
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC