Red Hat Bugzilla – Bug 440275
CVE-2008-1628 audit: audit_log_user_command() Buffer Overflow
Last modified: 2008-04-09 01:20:53 EDT
Secunia advisory SA29617:
A vulnerability has been reported in Linux Audit, which potentially can be
exploited by malicious, local users to gain escalated privileges.
The vulnerability is caused due to a boundary error within the
"audit_log_user_command()" function in lib/audit_logging.c. This can be
exploited to cause a stack-based buffer overflow via an overly long "command"
argument and potentially execute arbitrary code with the privileges of the
application using libaudit.
The vulnerability is reported in versions prior to 1.7.
Further clarification from Steve Grubb:
Vulnerable function audit_log_user_command() was added in audit 1.4, hence
problem exists in Red Hat Enterprise Linux 5.1 and Fedora 7 and later.
However, the only application that currently known to use this interface is
sudo, and only in version currently in Fedora Rawhide/devel. No application in
Red Hat Enterprise Linux 5.1 uses this audit function and is affected by this
Additionally, this buffer overflow is caught by FORTIFY_SOURCE, so the privilege
escalation is not possible, this only can cause an application crash. Crash of
sudo is not considered a security issue.
Due to this, this issue will not be treated as security sensitive and will be
addressed in updated audit packages in Red Hat Enterprise Linux 5.2 as
non-security bug fix.
audit-1.6.8-4.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.