Todd Miller Sudo 'Runas_Alias' Supplementary Group Local Privilege Escalation Vulnerability

Bugtraq ID:	33517
Class:	Design Error
CVE:	CVE-2009-0034 CVE-2011-0008
Remote:	No
Local:	Yes
Published:	Jan 29 2009 12:00AM
Updated:	Apr 13 2015 09:45PM
Credit:	Harald Koenig
Vulnerable:	VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Todd Miller Sudo 1.6.9 p19 Todd Miller Sudo 1.6.9 p18 Todd Miller Sudo 1.6.9 p17 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 rPath rPath Linux 2 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Pardus Linux 2008 0 OpenBSD OpenBSD 4.4 OpenBSD OpenBSD 4.3 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux
Not Vulnerable:	Todd Miller Sudo 1.7 Todd Miller Sudo cvs

Todd Miller Sudo 'Runas_Alias' Supplementary Group Local Privilege Escalation Vulnerability

Todd Miller 'sudo' is prone to a local privilege-escalation vulnerability because it fails to correctly validate certain nondefault rules in the 'sudoer' configuration file.

Local attackers could exploit this issue to run arbitrary commands as the 'root' user. Successful exploits can completely compromise an affected computer.

This issue affects 'sudo' 1.6.9 p17 through 1.6.9 p19; other versions may also be affected.

Todd Miller Sudo 'Runas_Alias' Supplementary Group Local Privilege Escalation Vulnerability

Local attackers can use readily available commands to exploit this issue.

Todd Miller Sudo 'Runas_Alias' Supplementary Group Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.


OpenBSD OpenBSD 4.3

• OpenBSD 011_sudo.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/011_sudo.patch

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva sudo-1.6.9p13-1.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva sudo-1.6.9p13-1.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_powerpc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p10-1ubunt u3.4_powerpc.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p10-1ubuntu3.4_powe rpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p17-1ubunt u2.1_powerpc.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p17-1ubuntu2.1_powe rpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p17-1ubuntu2.1_i386.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p17-1ubun tu2.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_sparc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p10-1ubunt u3.4_sparc.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_sparc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p10-1ubuntu3.4_spar c.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva sudo-1.7.4p6-0.1mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva sudo-1.6.9p5-1.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p10-1ubuntu3.4_amd64.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p10-1ubun tu3.4_amd64.deb

MandrakeSoft Enterprise Server 5

• Mandriva sudo-1.7.4p6-0.1mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva sudo-1.6.9p5-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva sudo-1.7.4p6-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/

OpenBSD OpenBSD 4.4

• OpenBSD 011_sudo.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.4/common/011_sudo.patch

Mandriva Linux Mandrake 2010.0

• Mandriva sudo-1.7.4p6-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_lpia.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p10-1ubunt u3.4_lpia.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_lpia.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p10-1ubuntu3.4_lpia .deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p17-1ubunt u2.1_lpia.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p17-1ubuntu2.1_lpia .deb

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva sudo-1.7.4p6-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p17-1ubunt u2.1_sparc.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p17-1ubuntu2.1_spar c.deb

Mandriva Linux Mandrake 2010.1

• Mandriva sudo-1.7.4p6-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva sudo-1.6.9p17-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva sudo-1.7.4p6-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p10-1ubuntu3.4_i386.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p10-1ubun tu3.4_i386.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva sudo-1.6.9p17-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva sudo-1.7.4p6-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

VMWare ESX Server 4.0

• VMWare ESX400-200906001
  http://tinyurl.com/ncfu5s

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p17-1ubuntu2.1_amd64.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p17-1ubun tu2.1_amd64.deb

Todd Miller Sudo 'Runas_Alias' Supplementary Group Local Privilege Escalation Vulnerability

References:

• Bug 468923 - VUL-0: sudo: root leak in sudo/sudoers (Harald Koenig)
  
• Diff for /sudo/parse.c between version 1.160.2.21 and 1.160.2.22 (Todd Miller)
  
• OpenBSD 4.3 Errata Page (OpenBSD)
  
• OpenBSD 4.4 release errata & patch list (OpenBSD)
  
• Sudo Homepage (Todd Miller)
  
• sudo root privilege escalation with some configurations CVE-2009-0034 (Michael K. Johnson)