Sudo Python Environment Variable Handling Security Bypass Vulnerability

Bugtraq ID:	16184
Class:	Input Validation Error
CVE:	CVE-2006-0151
Remote:	No
Local:	Yes
Published:	Jan 09 2006 12:00AM
Updated:	Dec 22 2006 12:02AM
Credit:	Tavis Ormandy is credited with the discovery of this vulnerability.
Vulnerable:	Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 Todd Miller Sudo 1.6.8 p9 Todd Miller Sudo 1.6.8 p8 + OpenPKG OpenPKG 2.4 + OpenPKG OpenPKG Current + Redhat Fedora Core4 Todd Miller Sudo 1.6.8 p7 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 + OpenPKG OpenPKG 2.3 Todd Miller Sudo 1.6.8 p5 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 Todd Miller Sudo 1.6.8 p2 + Trustix Secure Linux 2.2 Todd Miller Sudo 1.6.8 p12 Todd Miller Sudo 1.6.8 p1 + Mandriva Linux Mandrake 10.2 x86_64 + Mandriva Linux Mandrake 10.2 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + OpenPKG OpenPKG 2.2 + OpenPKG OpenPKG Current Todd Miller Sudo 1.6.8 Todd Miller Sudo 1.6.7 p5 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + OpenPKG OpenPKG 2.1 + Redhat Fedora Core3 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Todd Miller Sudo 1.6.7 Todd Miller Sudo 1.6.6 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Slackware Linux 8.0 Todd Miller Sudo 1.6.5 p2 + NetBSD NetBSD 1.5.2 + OpenBSD OpenBSD 3.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha + SuSE Linux 8.0 i386 + SuSE Linux 8.0 Todd Miller Sudo 1.6.5 p1 + Slackware Linux 8.0 Todd Miller Sudo 1.6.5 Todd Miller Sudo 1.6.4 p2 Todd Miller Sudo 1.6.4 p1 Todd Miller Sudo 1.6.4 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha Todd Miller Sudo 1.6.3 p7 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Slackware Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 Todd Miller Sudo 1.6.3 p6 + Guardian Digital Engarde Secure Linux 1.0.1 + Guardian Digital Engarde Secure Linux 1.0.1 + HP Secure OS software for Linux 1.0 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 alpha + SuSE Linux 7.2 i386 + SuSE Linux 7.2 + SuSE Linux 7.2 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 alpha + SuSE Linux 7.1 + SuSE Linux 7.1 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 alpha + SuSE Linux 7.0 + SuSE Linux 7.0 + Wirex Immunix OS 7.0 + Wirex Immunix OS 7.0 Todd Miller Sudo 1.6.3 p5 Todd Miller Sudo 1.6.3 p4 + Slackware Linux 7.1 Todd Miller Sudo 1.6.3 p3 Todd Miller Sudo 1.6.3 p2 Todd Miller Sudo 1.6.3 p1 Todd Miller Sudo 1.6.3 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha Todd Miller Sudo 1.6.2 - Debian Linux 2.2 Todd Miller Sudo 1.6.1 Todd Miller Sudo 1.6 Todd Miller Sudo 1.5.9 + SuSE Linux 6.4 ppc + SuSE Linux 6.4 i386 + SuSE Linux 6.4 Todd Miller Sudo 1.5.8 Todd Miller Sudo 1.5.7 Todd Miller Sudo 1.5.6 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 2.1 x86_64 MandrakeSoft Corporate Server 2.1 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0
Not Vulnerable:	Todd Miller Sudo 1.6.8 p12

Sudo Python Environment Variable Handling Security Bypass Vulnerability

Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables.

A local attacker with the ability to run Python scripts can exploit this vulnerability to gain access to an interactive Python prompt. That attacker may then execute arbitrary code with elevated privileges, facilitating the complete compromise of affected computers.

An attacker must have the ability to run Python scripts through Sudo to exploit this vulnerability.

This issue is similar to BID 15394 (Sudo Perl Environment Variable Handling Security Bypass Vulnerability).

Sudo Python Environment Variable Handling Security Bypass Vulnerability

An exploit is not required. Example exploit code has been provided by [email protected]:

• /data/vulnerabilities/exploits/sudo_local_perl_root.txt
• /data/vulnerabilities/exploits/sudo_local_python_exploit.txt

Sudo Python Environment Variable Handling Security Bypass Vulnerability

Solution:
Please see the referenced vendor advisories for more information and fixes.


Todd Miller Sudo 1.5.6

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.5.7

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.5.8

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.5.9

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p4

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p7

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p6

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.3 p3

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.4 p2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.4 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.4

• Mandriva sudo-1.6.7-0.p5.2.5.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://wwwnew.mandriva.com/en/downloads


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.5 p2

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.5 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.6

• Slackware sudo-1.6.8p12-i386-1.tgz
  Slackware 8.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.6.8p12-i386-1.tgz


• Slackware sudo-1.6.8p12-i386-1.tgz
  Slackware 9.0:ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/sudo-1.6.8p12-i386-1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.6.8p12-i386-1.tgz


• Slackware sudo-1.6.8p12-i386-1.tgz
  Slackware 9.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/s udo-1.6.8p12-i386-1.tgz


• Slackware sudo-1.6.8p12-i486-1.tgz
  10.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ sudo-1.6.8p12-i486-1.tgz


• Slackware sudo-1.6.8p12-i486-1.tgz
  Slackware 9.1:Slackware 9.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/s udo-1.6.8p12-i486-1.tgz


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.7 p5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.7

• Mandriva sudo-1.6.7-0.p5.2.5.C30mdk.i586.rpm
  Corporate 3.0:
  http://wwwnew.mandriva.com/en/downloads


• Mandriva sudo-1.6.7-0.p5.2.5.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://wwwnew.mandriva.com/en/downloads


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p9

• Slackware sudo-1.6.8p12-i486-1.tgz
  Slackware 10.2:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ sudo-1.6.8p12-i486-1.tgz


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html


• Trustix sudo-1.6.8p12-1tr.i586.rpm
  TSL 3.0
  ftp://ftp.trustix.org/pub/trustix/updates

Todd Miller Sudo 1.6.8 p5

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8

• Slackware sudo-1.6.8p12-i486-1.tgz
  Slackware 10.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ sudo-1.6.8p12-i486-1.tgz


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p8

• Mandriva sudo-1.6.8p8-2.3.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads


• Mandriva sudo-1.6.8p8-2.3.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads


• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p1

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Todd Miller Sudo 1.6.8 p2

• Trustix sudo-1.6.8p12-1tr.i586.rpm
  TSL 3.0
  ftp://ftp.trustix.org/pub/trustix/updates

Todd Miller Sudo 1.6.8 p7

• Todd Miller sudo-1.6.8p12.tar.gz
  http://www.sudo.ws/sudo/download.html

Sudo Python Environment Variable Handling Security Bypass Vulnerability

References:

• Perl scripts run via Sudo can be subverted (Todd Miller)
  
• Sudo Homepage (Todd Miller)