Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

Bugtraq ID:	38362
Class:	Design Error
CVE:	CVE-2010-0426
Remote:	No
Local:	Yes
Published:	Jan 28 2010 12:00AM
Updated:	Apr 13 2015 09:16PM
Credit:	Slouching
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Todd Miller Sudo 1.7.2 p3 Todd Miller Sudo 1.7 Todd Miller Sudo 1.6.9 p19 Todd Miller Sudo 1.6.9 p18 Todd Miller Sudo 1.6.9 p17 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux x86_64 -current Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 rPath rPath Linux 2 rPath Appliance Platform Linux Service 2 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Avaya Voice Portal 5.0 Avaya Aura System Platform 1.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 5.2
Not Vulnerable:	Todd Miller Sudo 1.7.2 p4

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

Todd Miller 'sudo' is prone to a local privilege-escalation vulnerability because it fails to correctly handle the 'sudoedit' command.

Local attackers could exploit this issue to run arbitrary commands as the 'root' user. Successful exploits can completely compromise an affected computer.

This issue affects 'sudo' 1.6.9 through 1.7.2p3.

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

Local attackers can use readily available commands to exploit this issue.

The following exploit code is available:

• /data/vulnerabilities/exploits/38362.sh

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux 12.0

• Slackware sudo-1.7.2p6-i486-1_slack12.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ sudo-1.7.2p6-i486-1_slack12.0.tgz

Debian Linux 5.0 ia-64

• Debian sudo-ldap_1.6.9p17-2+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17 -2+lenny1_ia64.deb

Slackware Linux -current

• Slackware sudo-1.7.2p6-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/s udo-1.7.2p6-i486-1.txz

Slackware Linux 12.2

• Slackware sudo-1.7.2p6-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ sudo-1.7.2p6-i486-1_slack12.2.tgz

Debian Linux 5.0 alpha

• Debian sudo-ldap_1.6.9p17-2+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17 -2+lenny1_alpha.deb


• Debian sudo_1.6.9p17-2+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+le nny1_alpha.deb

Debian Linux 5.0 mipsel

• Debian sudo_1.6.9p17-2+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+le nny1_mipsel.deb

Slackware Linux 12.1

• Slackware sudo-1.7.2p6-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ sudo-1.7.2p6-i486-1_slack12.1.tgz

Debian Linux 5.0 sparc

• Debian sudo_1.6.9p17-2+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+le nny1_sparc.deb

Slackware Linux x86_64 -current

• Slackware sudo-1.7.2p6-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ ap/sudo-1.7.2p6-x86_64-1.txz

Debian Linux 5.0 ia-32

• Debian sudo_1.6.9p17-2+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+le nny1_i386.deb

Debian Linux 5.0 s/390

• Debian sudo-ldap_1.6.9p17-2+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17 -2+lenny1_s390.deb

Slackware Linux 13.0 x86_64

• Slackware sudo-1.7.2p6-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/sudo-1.7.2p6-x86_64-1_slack13.0.txz

Debian Linux 5.0 hppa

• Debian sudo_1.6.9p17-2+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+le nny1_hppa.deb

Debian Linux 5.0 arm

• Debian sudo_1.6.9p17-2+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+le nny1_arm.deb

Todd Miller Sudo 1.6.9 p18

• Todd Miller sudo-1.7.2p4.tar.gz
  http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz

Todd Miller Sudo 1.6.9 p19

• Todd Miller sudo-1.7.2p4.tar.gz
  http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz

Todd Miller Sudo 1.6.9 p17

• Todd Miller sudo-1.7.2p4.tar.gz
  http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz

Todd Miller Sudo 1.7

• Todd Miller sudo-1.7.2p4.tar.gz
  http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz

Todd Miller Sudo 1.7.2 p3

• Todd Miller sudo-1.7.2p4.tar.gz
  http://www.sudo.ws/sudo/dist/sudo-1.7.2p4.tar.gz

Slackware Linux 10.0

• Slackware sudo-1.7.2p6-i486-1_slack10.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ sudo-1.7.2p6-i486-1_slack10.0.tgz

Slackware Linux 10.1

• Slackware sudo-1.7.2p6-i486-1_slack10.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ sudo-1.7.2p6-i486-1_slack10.1.tgz

Slackware Linux 10.2

• Slackware sudo-1.7.2p6-i486-1_slack10.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ sudo-1.7.2p6-i486-1_slack10.2.tgz

Slackware Linux 8.1

• Slackware sudo-1.7.2p6-i386-1_slack8.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.7.2p6-i386-1_slack8.1.tgz

Slackware Linux 9.0

• Slackware sudo-1.7.2p6-i386-1_slack9.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/s udo-1.7.2p6-i386-1_slack9.0.tgz

Slackware Linux 9.1

• Slackware sudo-1.7.2p6-i486-1_slack9.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/s udo-1.7.2p6-i486-1_slack9.1.tgz

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

References:

• Current Stable Version of Sudo (Todd Miller)
  
• Debian Bug report logs - #570737 (Debian)
  
• Sudo Homepage (Todd Miller)
  
• The use of sudoedit command question (slouching)
  
• Todd Miller Sudo local root exploit discovered by Slouching (Kingcope )
  
• 2014-11 Security Bulletin: CTPView: Multiple Security vulnerabilities resolved b (Juniper)
  
• ASA-2010-074 (Avaya)
  
• ASA-2010-074 sudo security update (RHSA-2010-0122) (Avaya)