OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2005.012
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2005.012
Advisory Published:      2008-10-06 23:07 UTC

Issue Id (internal):     OpenPKG-SI-20050623.02
Issue First Created:     2005-06-23
Issue Last Modified:     2006-11-28
Issue Revision:          05


Subject Name:            sudo
Subject Summary:         Switch User Command
Subject Home:            http://www.sudo.ws/
Subject Versions:        * <= 1.6.8p8

Vulnerability Id:        CVE-2005-1993
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           local system
Attack Impact:           privilege escalation, arbitrary code execution

Description:
    According to a vendor security advisory [0] based on hints from
    Charles Morris, a race condition exists in the command pathname
    handling of Sudo [1] prior to version 1.6.8p9. This could allow a
    user with Sudo privileges to run arbitrary commands. Exploitation of
    the bug requires that the user be allowed to run one or more commands
    via Sudo and be able to create symbolic links in the filesystem.
    Furthermore, an entry in the "sudoers" file giving another user access
    to the "ALL" pseudo-command must follow the user's entry for the race
    to exist.

References:
    [0] http://www.sudo.ws/sudo/alerts/path_race.html
    [1] http://www.sudo.ws/
    [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1993
    [3] http://www.openpkg.org/tutorial.html#regular-source
    [4] http://www.openpkg.org/tutorial.html#regular-binary
    [5] ftp://ftp.openpkg.org/release/2.4/UPD/sudo-1.6.8p8-2.4.1.src.rpm
    [6] ftp://ftp.openpkg.org/release/2.3/UPD/sudo-1.6.8p7-2.3.1.src.rpm
    [7] ftp://ftp.openpkg.org/release/2.4/UPD/
    [8] ftp://ftp.openpkg.org/release/2.3/UPD/
    [9] http://www.openpkg.org/security.html#signature


Primary Package Name:    sudo
Primary Package Home:    http://openpkg.org/go/package/sudo

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.3-SOLID         sudo-1.6.8p7-2.3.0
OpenPKG Community        2.4-SOLID         sudo-1.6.8p8-2.4.0
OpenPKG Community        CURRENT           sudo-1.6.8p8-20050422

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.3-SOLID         sudo-1.6.8p7-2.3.1
OpenPKG Community        2.4-SOLID         sudo-1.6.8p8-2.4.1
OpenPKG Community        CURRENT           sudo-1.6.8p9-20060620