Bug 567337 (CVE-2010-0426)
Summary: | CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | amarecek, dkopecek, jlieskov, kreilly, pasteur, pvrabec, qe-baseos-security |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2010-03-29 08:56:08 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 567675, 567676, 567689, 567691 | ||
Bug Blocks: | |||
Attachments: |
Description
Vincent Danen
2010-02-22 17:08:38 UTC
The relevant section in the sudoers(5) manpage states that "sudoedit" should be a magic command so should not require the full path: Cmnd ::= '!'* commandname | '!'* directory | '!'* "sudoedit" | '!'* Cmnd_Alias ... The special command "sudoedit" is used to permit a user to run sudo with the -e option (or as sudoedit). It may take command line arguments just as a normal command does. Created attachment 395599 [details]
patch from upstream to fix the flaw in sudo 1.7.x
Created attachment 395600 [details]
patch backported to sudo 1.6.x
Created attachment 395605 [details]
patch from upstream to fix the flaw in sudo 1.7.x (simplified)
Todd sent this instead as a simplified patch.
Created attachment 395606 [details]
patch backported to sudo 1.6.x (simplified)
This is CVE-2010-0426. This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0122 https://rhn.redhat.com/errata/RHSA-2010-0122.html This issue did NOT affect the versions of the sudo package, as shipped with Red Hat Enterprise Linux 3 and 4. This issue affects the current versions of the sudo package, as shipped with Fedora release of 11 and 12. Please fix. sudo-1.7.2p5-1.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/sudo-1.7.2p5-1.fc11 sudo-1.7.2p5-1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/sudo-1.7.2p5-1.fc12 sudo-1.7.2p5-1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/sudo-1.7.2p5-1.fc12 sudo-1.7.2p5-1.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/sudo-1.7.2p5-1.fc13 sudo-1.7.2p5-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. sudo-1.7.2p5-1.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report. sudo-1.7.2p5-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. |