SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Sudo Vendors:   Miller, Todd C.
(Slackware Issues Fix) Re: Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges
SecurityTracker Alert ID:  1004169
SecurityTracker URL:  http://securitytracker.com/id/1004169
CVE Reference:   CVE-2002-0184   (Links to External Site)
Updated:  Nov 20 2003
Original Entry Date:  Apr 26 2002
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.6.5p2 and prior
Description:   A vulnerability has been reported in the sudo utility. A local user may be able to obtain root privileges.

Global InterSec reported an off-by-five heap overflow in 'sudo'. A local user can apparently call sudo with a specially formatted argument for the -p command line option to trigger the overflow. It is reported that sudo may not correctly allocate memory when parsing the '%h' (hostname) or '%u' (username) strings in the argument in some situations. A local user could potentially trigger the overflow and execute arbitrary code with root privileges.

The exact nature of the conditions required to exploit this flaw were not provided. However, it is reported that the compile-time options and the length of the hostname may affect whether the application is vulnerable or not.

Impact:   A local user may be able to execute arbitrary code with root privileges in certain situations.
Solution:   A fix has been released for Slackware:

Updated sudo package for Slackware 7.1:

ftp://ftp.slackware.com/pub/slackware/slackware-7.1/patches/packages/sudo.tgz

Updated sudo package for Slackware 8.0:

ftp://ftp.slackware.com/pub/slackware/slackware-8.0/patches/packages/sudo.tgz

Updated sudo package for Slackware -current:

ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/sudo-1.6.6-i386-1.tgz

The MD5 signatures are:

Slackware 7.1:

1f2eb2c0e01c5d2182431cc401f78a89 sudo.tgz

Slackware 8.0:

d0598233fefeb9d37450eec10a087e07 sudo.tgz

Slackware -current:

26c70a9a740823353300b23f110b3cca sudo-1.6.6-i386-1.tgz

To install, as root, upgrade to the new sudo.tgz package:

# upgradepkg sudo.tgz

Vendor URL:  www.courtesan.com/sudo/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Slackware)
Underlying OS Comments:  7.1, 8.0

Message History:   This archive entry is a follow-up to the message listed below.
Apr 25 2002 Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges



 Source Message Contents

Subject:  [slackware-security] sudo upgrade fixes a potential vulnerability



New sudo packages are available to fix a security problem which may allow
users to become root, or to execute arbitrary code as root.

Here's the information from the Slackware 8.0 ChangeLog:

----------------------------
Thu Apr 25 12:00:50 PDT 2002
patches/packages/sudo.tgz:  Upgraded to sudo-1.6.6.
  This version of sudo fixes a security problem whereby a local user may gain
  root access through corruption of the heap (Off-By-Five).
  This issue was discovered by Global InterSec LLC, and more information may
  be found on their web site:
  http://www.globalintersec.com/adv/sudo-2002041701.txt
  The discussion on the site indicates that this problem may only be exploitable
  on systems that use PAM, which Slackware does not use.  However, in the
  absence of proof, it still seems prudent to upgrade sudo immediately.
  (* Security fix *)
----------------------------


WHERE TO FIND THE NEW PACKAGES:
-------------------------------

Updated sudo package for Slackware 7.1:
ftp://ftp.slackware.com/pub/slackware/slackware-7.1/patches/packages/sudo.tgz

Updated sudo package for Slackware 8.0:
ftp://ftp.slackware.com/pub/slackware/slackware-8.0/patches/packages/sudo.tgz

Updated sudo package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/sudo-1.6.6-i386-1.tgz


MD5 SIGNATURE:
--------------

Here is the md5sum for the package:

Slackware 7.1:
1f2eb2c0e01c5d2182431cc401f78a89  sudo.tgz

Slackware 8.0:
d0598233fefeb9d37450eec10a087e07  sudo.tgz

Slackware -current:
26c70a9a740823353300b23f110b3cca  sudo-1.6.6-i386-1.tgz


INSTALLATION INSTRUCTIONS:
--------------------------

As root, upgrade to the new sudo.tgz package:
# upgradepkg sudo.tgz

Remember, it's also a good idea to backup configuration files before
upgrading packages.

- Slackware Linux Security Team
  http://www.slackware.com


+------------------------------------------------------------------------+
| HOW TO REMOVE YOURSELF FROM THIS MAILING LIST:                         |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back.  Follow the instructions to  |
| complete the unsubscription.  Do not reply to this message to          |
| unsubscribe!                                                           |
+------------------------------------------------------------------------+


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC