Updated: April 26, 2002
Affected
Date: Thu, 25 Apr 2002 10:34:13 -0600
From: Todd C. Miller
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: April 26, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE----- Debian Security Advisory DSA-128-1 security@debian.org http://www.debian.org/security/ Wichert Akkerman April 26, 2002 Package : sudo Problem type : buffer overflow Debian-specific: no fc found a buffer overflow in the variable expansion code used by sudo for its prompt. Since sudo is necessarily installed suid root a local user can use this to gain root access. This has been fixed in version 1.6.2-2.2 and we recommend that you upgrade your sudo package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.2 alias potato Potato was released for alpha, arm, i386, m68k, powerpc and sparc. Source archives: http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.diff.gz MD5 checksum: 958560c409b43bd13463b3d380fc534a http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.dsc MD5 checksum: 7323f0f3614513156120ccc4772524f8 http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2.orig.tar.gz MD5 checksum: dd5944c880fd5cc56bc0f0199e92d2b4 Alpha architecture: http://security.debian.org/dists/stable/updates/main/binary-alpha/sudo_1.6.2p2-2.2_alpha.deb MD5 checksum: 66cb0d4f730560fddba65e44dd78c34d ARM architecture: http://security.debian.org/dists/stable/updates/main/binary-arm/sudo_1.6.2p2-2.2_arm.deb MD5 checksum: f74bae46ebd07bd8f430261153d13f90 Intel IA-32 architecture: http://security.debian.org/dists/stable/updates/main/binary-i386/sudo_1.6.2p2-2.2_i386.deb MD5 checksum: 9ac9b91818dd7b2f2888aa39aac0da98 Motorola 680x0 architecture: http://security.debian.org/dists/stable/updates/main/binary-m68k/sudo_1.6.2p2-2.2_m68k.deb MD5 checksum: 46f6d595363d23c96701cd303511e1a5 PowerPC architecture: http://security.debian.org/dists/stable/updates/main/binary-powerpc/sudo_1.6.2p2-2.2_powerpc.deb MD5 checksum: 66c23d2544e9a8f19c57c919a4a751c9 Sun Sparc architecture: http://security.debian.org/dists/stable/updates/main/binary-sparc/sudo_1.6.2p2-2.2_sparc.deb MD5 checksum: 9654ecac0230abe0f28524469fb5887e These packages will be moved into the stable distribution on its next revision. apt-get: deb http://security.debian.org/ stable/updates main dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQB1AwUBPMiNiqjZR/ntlUftAQErEwL/Xi3i/N5tGqezLTsuJlgChy6MLnX7gJG4 cMa5MzW+1xUH39xz6JAgPKQv9C4FyPqgEOOwa5xt/0vkNasj8ARiu/avLM4Uk6uS 22t9YWRjlnP4tPIi4DPhv20LFu1jeSNH =0Rd2 -----END PGP SIGNATURE-----
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: April 26, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 Mandrake Linux Security Update Advisory Package name: sudo
Advisory ID: MDKSA-2002:028
Date: April 25th, 2002
Affected versions: 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1
Single Network Firewall 7.2 Problem Description: A problem was discovered by fc, with further research by Global
InterSec, in the sudo program with the password prompt parameter
(-p). Sudo can be tricked into allocating less memory than it should
for the prompt and in certain conditions it is possible to exploit this
flaw to corrupt the heap in such a way that could be used to execute
arbitary commands. Because sudo is generally suid root, this can lead
to an elevation of privilege for local users. References: http://www.globalintersec.com/adv/sudo-2002041701.txt Updated Packages: Linux-Mandrake 7.1: 2214bb7c879f0c34425d379795a447ee 7.1/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 7.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Linux-Mandrake 7.2: 53cd161682fc5ec047bbab190037e7cb 7.2/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 7.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Mandrake Linux 8.0: a35538cd7efe7c9a34a6dc81b767e3ea 8.0/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 8.0/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Mandrake Linux 8.0/ppc: 867b935b9e39afaca5535c25673f2860 ppc/8.0/RPMS/sudo-1.6.4-3.1mdk.ppc.rpm
552ef456ff9fd4028bd8371b808adae6 ppc/8.0/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Mandrake Linux 8.1: d6cccdaaca2a338bcd75290bef1c3440 8.1/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 8.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Mandrake Linux 8.1/ia64: 80e0441fe8ebdd804adbe0fb3127c950 ia64/8.1/RPMS/sudo-1.6.4-3.1mdk.ia64.rpm
552ef456ff9fd4028bd8371b808adae6 ia64/8.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Mandrake Linux 8.2: 752d02e218508c12a3d4500e3c8fe842 8.2/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 8.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Mandrake Linux 8.2/ppc: fa9ee180fdf44ed92f9c27ee96096471 ppc/8.2/RPMS/sudo-1.6.4-3.1mdk.ppc.rpm
552ef456ff9fd4028bd8371b808adae6 ppc/8.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Corporate Server 1.0.1: 2214bb7c879f0c34425d379795a447ee 1.0.1/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 1.0.1/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Single Network Firewall 7.2: 53cd161682fc5ec047bbab190037e7cb snf7.2/RPMS/sudo-1.6.4-3.1mdk.i586.rpm
552ef456ff9fd4028bd8371b808adae6 snf7.2/SRPMS/sudo-1.6.4-3.1mdk.src.rpm Bug IDs fixed (see https://qa.mandrakesoft.com for more information): To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you. If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command: rpm --checksig
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: April 26, 2002
Affected
Please see http://www.redhat.com/mailing-lists/redhat-watch-list/msg00365.html.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: April 26, 2002
Affected
New sudo packages are available to fix a security problem which may allow users to become root, or to execute arbitrary code as root. Here's the information from the Slackware 8.0 ChangeLog: Thu Apr 25 12:00:50 PDT 2002 patches/packages/sudo.tgz: Upgraded to sudo-1.6.6. This version of sudo fixes a security problem whereby a local user may gain root access through corruption of the heap (Off-By-Five). This issue was discovered by Global InterSec LLC, and more information may be found on their web site: http://www.globalintersec.com/adv/sudo-2002041701.txt The discussion on the site indicates that this problem may only be exploitable on systems that use PAM, which Slackware does not use. However, in the absence of proof, it still seems prudent to upgrade sudo immediately. (* Security fix *) WHERE TO FIND THE NEW PACKAGES: Updated sudo package for Slackware 7.1: ftp://ftp.slackware.com/pub/slackware/slackware-7.1/patches/packages/sudo.tgz Updated sudo package for Slackware 8.0: ftp://ftp.slackware.com/pub/slackware/slackware-8.0/patches/packages/sudo.tgz Updated sudo package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/sudo-1.6.6-i386-1.tgz MD5 SIGNATURE: Here is the md5sum for the package: Slackware 7.1: 1f2eb2c0e01c5d2182431cc401f78a89 sudo.tgz Slackware 8.0: d0598233fefeb9d37450eec10a087e07 sudo.tgz Slackware -current: 26c70a9a740823353300b23f110b3cca sudo-1.6.6-i386-1.tgz INSTALLATION INSTRUCTIONS: As root, upgrade to the new sudo.tgz package: # upgradepkg sudo.tgz Remember, it's also a good idea to backup configuration files before upgrading packages. - Slackware Linux Security Team http://www.slackware.com
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.