oss-security - CVE assignment notification -- CVE-2010-0427 -- sudo fails to reset group permissions if runas

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B83FFAC.5020609@redhat.com>
Date: Tue, 23 Feb 2010 17:17:48 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
CC: "Steven M. Christey" <coley@...us.mitre.org>,
        "Todd C. Miller" <Todd.Miller@...rtesan.com>
Subject: CVE assignment notification -- CVE-2010-0427 -- sudo fails to reset
 group permissions if runas_default set

Hi vendors,

   1, apologize for separate post (needed to investigate the
      issue first).

   2, more about sudo "fails to reset group permissions
      if runas_default set" issue:

      Sudo failed to properly reset group permissions, when
      'runas_default' option was used. If a local, unprivileged
      user was authorized by sudoers file to perform their
      sudo commands under default user account, it could lead
      to privilege escalation.

Upstream bug report:
   [1] http://www.gratisoft.us/bugzilla/show_bug.cgi?id=349

Upstream patch:
   [2] http://sudo.ws/repos/sudo/rev/aa0b6c01c462 (against v1.6 branch)
   [3] http://www.sudo.ws/cgi-bin/cvsweb/sudo/set_perms.c.diff?r1=1.30.2.7&> r2=1.30.2.8

Other references:
   [4] https://bugzilla.redhat.com/show_bug.cgi?id=567622

Affected versions:
   a, issue tested and confirmed in sudo-1.6.9p17 version, prior v1.6.x
      based versions might be also affected. Issue fixed
      in upstream 1.6.9p21 version.
   b, v1.7.x based versions of sudo are not affected by this
      flaw due the differences in the way sudoers file is parsed.

CVE: CVE identifier of CVE-2010-0427 has been already assigned to this issue.

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Thanks to Todd C. Miller for pointing me to [2] and sudo
       v1.7.x situation clarification.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.