Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

Bugtraq ID:	43019
Class:	Design Error
CVE:	CVE-2010-2956
Remote:	No
Local:	Yes
Published:	Sep 07 2010 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	Markus Wuethrich
Vulnerable:	VMWare ESX 4.1 VMWare ESX 4.0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.10 Todd Miller Sudo 1.7 Todd Miller Sudo 1.7.4p3 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux x86_64 -current Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 rPath rPath Linux 2 rPath Appliance Platform Linux Service 2 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Juniper CTPView 4.6 Juniper CTPView 4.5 Juniper CTPView 4.4 Juniper CTPView 4.3 Juniper CTPView 4.2 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya IQ 5.1 Avaya IQ 5 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Presence Services 6.0 Avaya Aura Communication Manager 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 5.2
Not Vulnerable:	Todd Miller Sudo 1.7.4p4 Juniper CTPView 7.0R1

Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu sudo-ldap_1.7.0-1ubuntu2.5_sparc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.7.0-1ubuntu2. 5_sparc.deb


• Ubuntu sudo_1.7.0-1ubuntu2.5_sparc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.7.0-1ubuntu2.5_sparc.d eb

Slackware Linux x86_64 -current

• Slackware sudo-1.7.4p4-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ ap/sudo-1.7.4p4-x86_64-1.txz


• Slackware sudo-1.7.4p4-x86_64-2.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ ap/sudo-1.7.4p4-x86_64-2.txz

Slackware Linux 12.0

• Slackware sudo-1.7.4p4-i486-1_slack12.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ sudo-1.7.4p4-i486-1_slack12.0.tgz


• Slackware sudo-1.7.4p4-i486-2_slack12.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ sudo-1.7.4p4-i486-2_slack12.0.tgz

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva sudo-1.7.0-1.6mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Slackware Linux -current

• Slackware sudo-1.7.4p4-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/s udo-1.7.4p4-i486-1.txz


• Slackware sudo-1.7.4p4-i486-2.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/s udo-1.7.4p4-i486-2.txz

Slackware Linux 12.2

• Slackware sudo-1.7.4p4-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ sudo-1.7.4p4-i486-1_slack12.2.tgz


• Slackware sudo-1.7.4p4-i486-2_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ sudo-1.7.4p4-i486-2_slack12.2.tgz

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu sudo-ldap_1.7.0-1ubuntu2.5_powerpc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.7.0-1ubuntu2. 5_powerpc.deb


• Ubuntu sudo_1.7.0-1ubuntu2.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.7.0-1ubuntu2.5_powerpc .deb

Slackware Linux 13.1 x86_64

• Slackware sudo-1.7.4p4-x86_64-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/sudo-1.7.4p4-x86_64-1_slack13.1.txz


• Slackware sudo-1.7.4p4-x86_64-2_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/sudo-1.7.4p4-x86_64-2_slack13.1.txz

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu sudo-ldap_1.7.0-1ubuntu2.5_lpia.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.7.0-1ubuntu2. 5_lpia.deb


• Ubuntu sudo_1.7.0-1ubuntu2.5_lpia.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.7.0-1ubuntu2.5_lpia.de b

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva sudo-1.7.2-0.p7.1.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 13.1

• Slackware sudo-1.7.4p4-i486-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ sudo-1.7.4p4-i486-1_slack13.1.txz


• Slackware sudo-1.7.4p4-i486-2_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ sudo-1.7.4p4-i486-2_slack13.1.txz

Mandriva Linux Mandrake 2010.0

• Mandriva sudo-1.7.2-0.p1.1.4mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 13.0 x86_64

• Slackware sudo-1.7.4p4-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/sudo-1.7.4p4-x86_64-1_slack13.0.txz


• Slackware sudo-1.7.4p4-x86_64-2_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/sudo-1.7.4p4-x86_64-2_slack13.0.txz

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva sudo-1.7.2-0.p1.1.4mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 12.1

• Slackware sudo-1.7.4p4-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ sudo-1.7.4p4-i486-1_slack12.1.tgz


• Slackware sudo-1.7.4p4-i486-2_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ sudo-1.7.4p4-i486-2_slack12.1.tgz

Mandriva Linux Mandrake 2010.1

• Mandriva sudo-1.7.2-0.p7.1.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu sudo-ldap_1.7.0-1ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.7.0 -1ubuntu2.5_i386.deb


• Ubuntu sudo_1.7.0-1ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.7.0-1ubuntu2 .5_i386.deb

Slackware Linux 13.0

• Slackware sudo-1.7.4p4-i486-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ sudo-1.7.4p4-i486-1_slack13.0.txz


• Slackware sudo-1.7.4p4-i486-2_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ sudo-1.7.4p4-i486-2_slack13.0.txz

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu sudo-ldap_1.7.0-1ubuntu2.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.7.0 -1ubuntu2.5_amd64.deb


• Ubuntu sudo_1.7.0-1ubuntu2.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.7.0-1ubuntu2 .5_amd64.deb

Slackware Linux 11.0

• Slackware sudo-1.7.4p4-i486-1_slack11.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/ sudo-1.7.4p4-i486-1_slack11.0.tgz


• Slackware sudo-1.7.4p4-i486-2_slack11.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/ sudo-1.7.4p4-i486-2_slack11.0.tgz

Mandriva Linux Mandrake 2009.1

• Mandriva sudo-1.7.0-1.6mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 10.0

• Slackware sudo-1.7.4p4-i486-1_slack10.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ sudo-1.7.4p4-i486-1_slack10.0.tgz


• Slackware sudo-1.7.4p4-i486-2_slack10.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ sudo-1.7.4p4-i486-2_slack10.0.tgz

Slackware Linux 10.1

• Slackware sudo-1.7.4p4-i486-1_slack10.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ sudo-1.7.4p4-i486-1_slack10.1.tgz


• Slackware sudo-1.7.4p4-i486-2_slack10.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ sudo-1.7.4p4-i486-2_slack10.1.tgz

Slackware Linux 10.2

• Slackware sudo-1.7.4p4-i486-1_slack10.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ sudo-1.7.4p4-i486-1_slack10.2.tgz


• Slackware sudo-1.7.4p4-i486-2_slack10.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ sudo-1.7.4p4-i486-2_slack10.2.tgz

Slackware Linux 8.1

• Slackware sudo-1.7.4p4-i386-1_slack8.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.7.4p4-i386-1_slack8.1.tgz


• Slackware sudo-1.7.4p4-i386-2_slack8.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s udo-1.7.4p4-i386-2_slack8.1.tgz

Slackware Linux 9.0

• Slackware sudo-1.7.4p4-i386-1_slack9.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/s udo-1.7.4p4-i386-1_slack9.0.tgz


• Slackware sudo-1.7.4p4-i386-2_slack9.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/s udo-1.7.4p4-i386-2_slack9.0.tgz

Slackware Linux 9.1

• Slackware sudo-1.7.4p4-i486-1_slack9.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/s udo-1.7.4p4-i486-1_slack9.1.tgz


• Slackware sudo-1.7.4p4-i486-2_slack9.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/s udo-1.7.4p4-i486-2_slack9.1.tgz

Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

References:

• Avaya Security Advisory ASA-2010-261 (Avaya)
  
• Flaw in Runas group matching (Todd Miller)
  
• Sudo Homepage (Todd Miller)
  
• VMware ESX 4.0, Patch ESX400-201101404-SG: Updates sudo package (VMWare)
  
• VMware ESX 4.0, Patch Release ESX400-201101001 (VMWare)
  
• 2014-11 Security Bulletin: CTPView: Multiple Security vulnerabilities resolved b (Juniper)