Bug 820677 (CVE-2012-2337) - CVE-2012-2337 sudo: Multiple netmask values used in Host / Host_List configuration cause any host to be allowed access
Summary: CVE-2012-2337 sudo: Multiple netmask values used in Host / Host_List configur...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-2337
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 740884 822175 829756 829757 829766
Blocks: 820682
TreeView+ depends on / blocked
 
Reported: 2012-05-10 16:32 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:52 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-07-16 16:26:58 UTC


Attachments (Terms of Use)
Proposed sudo-v1.7.x patch from Todd C.Miller (943 bytes, patch)
2012-05-12 12:57 UTC, Jan Lieskovsky
no flags Details | Diff
Proposed sudo-v1.8.x patch from Todd C.Miller (1.06 KB, patch)
2012-05-12 12:58 UTC, Jan Lieskovsky
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1081 normal SHIPPED_LIVE Moderate: sudo security update 2012-07-16 19:55:07 UTC

Description Jan Lieskovsky 2012-05-10 16:32:11 UTC
A security flaw was found in the way sudo granted access for particular host, when multiple netmask values have been used in sudo's Host / Host_List configuration. Such configuration allowed unprivileged users, who were authorized by the sudoers file to run their sudo commands, to run these commands from any host regardless of the Host_List configuration (even from hosts, which were intended according to the Host_List netmask configuration not to allow execution of such commands according to the netmask).

Comment 2 Jan Lieskovsky 2012-05-10 16:35:59 UTC
This issue affects the versions of the sudo package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the sudo package, as shipped with Fedora release of 15 and 16.

Comment 4 Jan Lieskovsky 2012-05-12 12:57:04 UTC
Created attachment 583996 [details]
Proposed sudo-v1.7.x patch from Todd C.Miller

Comment 5 Jan Lieskovsky 2012-05-12 12:58:34 UTC
Created attachment 583997 [details]
Proposed sudo-v1.8.x patch from Todd C.Miller

Comment 6 Jan Lieskovsky 2012-05-14 16:33:46 UTC
The preliminary embargo date for this issue has been set to Wednesday, 2012-05-16.

Comment 7 Jan Lieskovsky 2012-05-16 14:45:31 UTC
Upstream advisory:
[1] http://www.sudo.ws/sudo/alerts/netmask.html

Comment 8 Jan Lieskovsky 2012-05-16 14:47:23 UTC
Created sudo tracking bugs for this issue

Affects: fedora-all [bug 822175]

Comment 9 Fedora Update System 2012-05-29 10:24:11 UTC
sudo-1.8.3p1-7.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 22 Fedora Update System 2012-07-12 18:55:52 UTC
sudo-1.8.3p1-3.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 23 errata-xmlrpc 2012-07-16 15:56:12 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2012:1081 https://rhn.redhat.com/errata/RHSA-2012-1081.html


Note You need to log in before you can comment on or make changes to this bug.