headers
Todd C. Miller | 20 Feb 2010 14:43
Favicon

sudo 1.7.2p3 released

Sudo version 1.7.2p3 is now available.  This is a bug fix release.

Download links:
    http://www.sudo.ws/sudo/dist/sudo-1.7.2p3.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/sudo-1.7.2p3.tar.gz

For a list of download mirror sites, see:
    http://www.sudo.ws/sudo/download.html

Sudo web site:
    http://www.sudo.ws/sudo/

Sudo web site mirrors:
    http://www.sudo.ws/sudo/mirrors.html

Major changes between sudo 1.7.2p2 and 1.7.2p3:

 * Fix printing of entries with multiple host entries on a single line.

 * Fix use after free when sending error messages via email.

 * Use setrlimit64(), if available, instead of setrlimit() when
   setting AIX resource limits since rlim_t is 32bits.

 * Fix size arg when realloc()ing include stack.

 * Avoid a duplicate fclose() of the sudoers file.

Major changes between sudo 1.7.2p1 and 1.7.2p2:
(Continue reading)

Permalink | Reply | 0 comments |
headers
Todd C. Miller | 25 Feb 2010 13:28
Favicon

Privilege escalation bug with sudoedit

Sudo versions 1.7.2p4 and 1.6.9p21 are now available.  These releases
fix a privilege escalation bug in the sudoedit functionality.

Summary:
    A flaw in exists in sudo's -e option (aka sudoedit) in sudo
    versions 1.6.9 through 1.7.2p3 that may give a user with
    permission to run sudoedit the ability to run arbitrary commands.

Sudo versions affected:
    1.6.9 through 1.7.2p3 inclusive.

Download links:
    http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/sudo-1.7.2p4.tar.gz
    http://www.sudo.ws/sudo/dist/sudo-1.6.9p21.tar.gz
    ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.tar.gz

Details:
    When sudo performs its command matching, there is a special
    case for pseudo-commands in the sudoers file (currently, the
    only pseudo-command is sudoedit).  Unlike a regular command,
    pseudo-commands do not begin with a slash ('/').

    The flaw is that sudo's the matching code would only check
    against the list of pseudo-commands if the user-specified command
    also contained no slashes.  As a result, if the user ran "sudo
    ./sudoedit" the normal matching code path was followed, which
    uses stat(2) to verify that the user-specified command matches
    the one in sudoers.  In this case, it would compare the
    "./sudoedit" specified by the user with "sudoedit" from the
(Continue reading)

Permalink | Reply | 0 comments |

Gmane