Sudo Heap Corruption Vulnerability

Bugtraq ID:	2829
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 22 2001 12:00AM
Updated:	Feb 22 2001 12:00AM
Credit:	Reportedly discovered by Chris Wilson <[email protected]>.
Vulnerable:	Todd Miller Sudo 1.6.3 p5 Todd Miller Sudo 1.6.3 p4 + Slackware Linux 7.1 Todd Miller Sudo 1.6.3 p3 Todd Miller Sudo 1.6.3 p2 Todd Miller Sudo 1.6.3 p1 Todd Miller Sudo 1.6.3 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha Todd Miller Sudo 1.6.2 - Debian Linux 2.2 Todd Miller Sudo 1.6.1 Todd Miller Sudo 1.6 Todd Miller Sudo 1.5.9 + SuSE Linux 6.4 ppc + SuSE Linux 6.4 i386 + SuSE Linux 6.4 Todd Miller Sudo 1.5.8 Todd Miller Sudo 1.5.7 Todd Miller Sudo 1.5.6
Not Vulnerable:	Todd Miller Sudo 1.6.3 p7 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Slackware Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 Todd Miller Sudo 1.6.3 p6 + Guardian Digital Engarde Secure Linux 1.0.1 + Guardian Digital Engarde Secure Linux 1.0.1 + HP Secure OS software for Linux 1.0 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 alpha + SuSE Linux 7.2 i386 + SuSE Linux 7.2 + SuSE Linux 7.2 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 alpha + SuSE Linux 7.1 + SuSE Linux 7.1 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 alpha + SuSE Linux 7.0 + SuSE Linux 7.0 + Wirex Immunix OS 7.0 + Wirex Immunix OS 7.0

Sudo Heap Corruption Vulnerability

Sudo (superuser do) is a security utility that allows administrator to give 'restricted' superuser privileges to certain users.

Sudo contains a locally exploitable buffer overrun vulnerability. The overrun condition exists in the logging component, and occurs when data to be logged is being split into substrings to be passed to syslog().

It has been found that the overrun, when it occurs in memory on the heap (depends on which function has called do_syslog()), is exploitable. Local users may gain root access if this vulnerability is exploited successfully.

Sudo Heap Corruption Vulnerability

Michel Kaempf has published proof of concept code.

• /data/vulnerabilities/exploits/sudoexp.c

Sudo Heap Corruption Vulnerability

Solution:
Version 1.6.3p7 is available, which has fixed the vulnerability. The vulnerability was originally fixed in release 1.6.3p6, which is superceded by p7.

Various vendors have released fixed packages.


Todd Miller Sudo 1.5.6

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.5.7

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.5.8

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.5.9

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.1

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Conectiva 4.0 i386 sudo-1.6.3p6-1cl.i386.rpm
  http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com .br/4.0/i386/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 4.0 i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com .br/4.0/i386/sudo-doc-1.6.3p6-1cl.i386.rpm


• Conectiva 4.0es i386 sudo-1.6.3p6-1cl.i386.rpm
  http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com .br/4.0es/i386/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 4.0es i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/sudo-doc-1.6.3p6-1cl.i3 86.rpm


• Conectiva 4.1 I386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 4.1 i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/sudo-doc-1.6.3p6-1cl.i386 .rpm


• Conectiva 4.2 i386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 4.2 i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/sudo-doc-1.6.3p6-1cl.i386 .rpm


• Conectiva 5.0 i386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 5.0 i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/sudo-doc-1.6.3p6-1cl.i386 .rpm


• Conectiva 5.1 i386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 5.1 i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/sudo-doc-1.6.3p6-1cl.i386 .rpm


• Conectiva 6.0 i386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/sudo-1.6.3p6-1cl.i386.rpm


• Conectiva 6.0 i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/sudo-doc-1.6.3p6-1cl.i386 .rpm


• Conectiva ecommerce i386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/sudo-1. 6.3p6-1cl.i386.rpm


• Conectiva graficas i386 sudo-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/sudo-1.6 .3p6-1cl.i386.rpm


• Conectiva graficas i386 sudo-doc-1.6.3p6-1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/sudo-doc -1.6.3p6-1cl.i386.rpm


• MandrakeSoft 1.0.1 sudo-1.6.3p6-1.2mdk.i586.rpm
  http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/1.0.1/RPM S/sudo-1.6.3p6-1.2mdk.i586.rpm


• MandrakeSoft 7.1 sudo-1.6.3p6-1.3mdk.i586.rpm
  http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.1/RPMS/ sudo-1.6.3p6-1.3mdk.i586.rpm


• MandrakeSoft 7.2 sudo-1.6.3p6-1.1mdk.i586.rpm
  http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.2/RPMS/ sudo-1.6.3p6-1.1mdk.i586.rpm


• Red Hat powertools 6.2 alpha sudo-1.6.3p6-0.6x.alpha.rpm
  ftp://updates.redhat.com/powertools/6.2/alpha/sudo-1.6.3p6-0.6x.alpha. rpm


• Red Hat powertools 6.2 i386 sudo-1.6.3p6-0.6x.i386.rpm
  ftp://updates.redhat.com/powertools/6.2/i386/sudo-1.6.3p6-0.6x.i386.rp m


• Red Hat powertools 6.2 sparc sudo-1.6.3p6-0.6x.sparc.rpm
  ftp://updates.redhat.com/powertools/6.2/sparc/sudo-1.6.3p6-0.6x.sparc. rpm


• Red Hat powertools 6.2 sudo-1.6.3p6-0.6x.src.rpm
  ftp://updates.redhat.com/powertools/6.2/SRPMS/sudo-1.6.3p6-0.6x.src.rp m


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz


• Trustix 1.1 sudo-1.6.3p6-1tr
  ftp://ftp.trustix.net/pub/Trustix/updates/sudo-1.6.3p6-1tr.i586.rpm


• Trustix 1.2 sudo-1.6.3p6-1tr
  ftp://ftp.trustix.net/pub/Trustix/updates/sudo-1.6.3p6-1tr.i586.rpm

Todd Miller Sudo 1.6.2

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Debian 2.2 alpha sudo_1.6.2p2-1potato1_alpha.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-alpha/sudo_1.6.2p2-1potato1_alpha.deb


• Debian 2.2 arm sudo_1.6.2p2-1potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/sudo_1.6.2p2-1potato1_arm.deb


• Debian 2.2 i386 sudo_1.6.2p2-1potato1_i386.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-i386/sudo_1.6.2p2-1potato1_i386.de


• Debian 2.2 m68k sudo_1.6.2p2-1potato1_m68k.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-m68k/sudo_1.6.2p2-1potato1_m68k.deb


• Debian 2.2 ppc sudo_1.6.2p2-1potato1_powerpc.deb
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/su do_1.6.2p2-1potato1_powerpc.deb


• Debian 2.2 sparc sudo_1.6.2p2-1potato1_sparc.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-sparc/sudo_1.6.2p2-1potato1_sparc.deb


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.3 p2

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.3 p5

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.3

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.3 p4

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.3 p3

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Todd Miller Sudo 1.6.3 p1

• Apple WebSharingUpdate 1.0
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=00733&plat form=osx&method=sa/WebSharingUpdate.dmg.bin


• Slackware current sudo.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slakware/ap1/s udo.tgz


• Todd Miller Sudo 1.6.3p7
  http://www.courtesan.com/sudo/dist/sudo-1.6.3p7.tar.gz

Sudo Heap Corruption Vulnerability

References:

• Sudo Homepage (Todd Miller)