oss-sec mailing list archives
Re: CVE assignment notification -- CVE-2010-0426 -- sudo improper pseudocommands file path check
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Tue, 23 Feb 2010 08:00:21 -0500
Here's my WIP writeup of this: Summary: A flaw in exists in sudo's -e option (aka sudoedit) in sudo versions 1.6.9 through 1.7.2p3 that may give a user with permission to run sudoedit the ability to run arbitrary commands. Sudo versions affected: 1.6.9 through 1.7.2p3 inclusive. Details When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file (currently, the only pseudo-command is sudoedit). Unlike a regular command, pseudo-commands do not begin with a slash ('/'). The flaw is that sudo's the matching code would only check against the list of pseudo-commands if the user-specified command also contained no slashes. As a result, if the user ran "sudo ./sudoedit" the normal matching code path was followed, which uses stat(2) to verify that the user-specified command matches the one in sudoers. In this case, it would compare the "./sudoedit" specified by the user with "sudoedit" from the sudoers file, resulting in a positive match. Impact: Exploitation of the bug requires that the sudoers file be configured to allow the attacker to run sudoedit. If no users have been granted access to sudoedit there is no impact. Successful exploitation of the bug will allow a user to run arbitrary commands for whichever user they have permission to run sudoedit as, typically root. Fix: The bug is fixed in sudo 1.7.2p4 and 1.6.9p21 Credit: This problem was brought to my attention by Glenn Waller and neonsignal. See also: http://sudo.ws/bugs/show_bug.cgi?id=389
Current thread:
- CVE assignment notification -- CVE-2010-0426 -- sudo improper pseudocommands file path check Jan Lieskovsky (Feb 23)
- Re: CVE assignment notification -- CVE-2010-0426 -- sudo improper pseudocommands file path check Todd C. Miller (Feb 23)
- Re: Re: CVE assignment notification -- CVE-2010-0426 -- sudo improper pseudocommands file path check Jamie Strandboge (Feb 25)
- Re: CVE assignment notification -- CVE-2010-0426 -- sudo improper pseudocommands file path check Todd C. Miller (Feb 23)