Secunia advisory SA29617: A vulnerability has been reported in Linux Audit, which potentially can be exploited by malicious, local users to gain escalated privileges. The vulnerability is caused due to a boundary error within the "audit_log_user_command()" function in lib/audit_logging.c. This can be exploited to cause a stack-based buffer overflow via an overly long "command" argument and potentially execute arbitrary code with the privileges of the application using libaudit. The vulnerability is reported in versions prior to 1.7. References: http://secunia.com/advisories/29617/ http://people.redhat.com/sgrubb/audit/ChangeLog
Further clarification from Steve Grubb: Vulnerable function audit_log_user_command() was added in audit 1.4, hence problem exists in Red Hat Enterprise Linux 5.1 and Fedora 7 and later. However, the only application that currently known to use this interface is sudo, and only in version currently in Fedora Rawhide/devel. No application in Red Hat Enterprise Linux 5.1 uses this audit function and is affected by this problem. Additionally, this buffer overflow is caught by FORTIFY_SOURCE, so the privilege escalation is not possible, this only can cause an application crash. Crash of sudo is not considered a security issue. Due to this, this issue will not be treated as security sensitive and will be addressed in updated audit packages in Red Hat Enterprise Linux 5.2 as non-security bug fix.
audit-1.6.8-4.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.