(OpenBSD Issues Patch for 3.x) Re: Sudo Utility Has Heap Overflow That May Let Local Users Execute Arbitrary Code with Root Privileges
|
|
SecurityTracker Alert ID: 1004156
|
|
CVE Reference: CVE-2002-0184
(Links to External Site)
|
Updated: Nov 19 2003
|
Original Entry Date: Apr 25 2002
|
Impact: Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.6.5p2 and prior
|
Description: A vulnerability has been reported in the sudo utility. A local user may be able to obtain root privileges.
Global InterSec reported an off-by-five heap overflow in 'sudo'. A local user can apparently call sudo with a specially formatted
argument for the -p command line option to trigger the overflow. It is reported that sudo may not correctly allocate memory when
parsing the '%h' (hostname) or '%u' (username) strings in the argument in some situations. A local user could potentially trigger
the overflow and execute arbitrary code with root privileges.
The exact nature of the conditions required to exploit this flaw
were not provided. However, it is reported that the compile-time options and the length of the hostname may affect whether the
application is vulnerable or not.
|
Impact: A local user may be able to execute arbitrary code with root privileges in certain situations.
|
Solution: OpenBSD has issued patches for OpenBSD 3.x:
For OpenBSD 3.0:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/020_sudo.patch
For OpenSD 3.1:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch
|
Vendor URL: www.courtesan.com/sudo/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: UNIX (OpenBSD)
|
Underlying OS Comments: 3.0, 3.1
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 25 Apr 2002 16:41:14 -0400
Subject: OpenBSD sudo patch for 3.0, 3.1
|
For OpenBSD 3.0:
020: SECURITY FIX: April 25, 2002
A bug in sudo(8) may allow an attacker to corrupt the heap by specifying
a custom prompt.
A source code patch exists which remedies the problem:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/020_sudo.patch
For OpenSD 3.1:
002: SECURITY FIX: April 25, 2002
A bug in sudo(8) may allow an attacker to corrupt the heap by specifying
a custom prompt.
A source code patch exists which remedies the problem:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch
|
|
