[USN-142-1] sudo vulnerability
Date: Tue, 21 Jun 2005 15:54:22 +0200
From: Martin Pitt <martin.pitt@canonical.com.>
To: [email protected]
Subject: [USN-142-1] sudo vulnerability
Message-ID: <20050621135422.GB10173@piware.de.>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="3uo+9/B/ebqu+fSQ"
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.16; AVE: 6.31.0.7; VDF: 6.31.0.89; host: sonne)
X-Virus-Scanned: antivirus-gw at tyumen.ru
--3uo+9/B/ebqu+fSQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Ubuntu Security Notice USN-142-1 June 21, 2005
sudo vulnerability
CAN-2005-1993
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
sudo
The problem can be corrected by upgrading the affected package to
version 1.6.7p5-1ubuntu4.2 (for Ubuntu 4.10), or 1.6.8p5-1ubuntu2.1
(for Ubuntu 5.04). In general, a standard system upgrade is
sufficient to effect the necessary changes.
Details follow:
Charles Morris discovered a race condition in sudo which could lead to
privilege escalation. If /etc/sudoers allowed a user the execution of
selected programs, and this was followed by another line containing
the pseudo-command "ALL", that user could execute arbitrary commands
with sudo by creating symbolic links at a certain time.
Please note that this does not affect a standard Ubuntu installation.
Updated packages for Ubuntu 4.10 (Warty Warthog):
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.7p5-1ubuntu4.2.diff.gz
Size/MD5: 19738 c0823e3947f35d25f259e7fd8f16f087
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.7p5-1ubuntu4.2.dsc
Size/MD5: 585 75d7496b2ccc5d4156cf64f7734e4671
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.7p5.orig.tar.gz
Size/MD5: 349785 55d503e5c35bf1ea83d38244e0242aaf
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.7p5-1ubuntu4.2_amd64.deb
Size/MD5: 156152 a1b87562400cf5bed227cb36c8f84f89
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.7p5-1ubuntu4.2_i386.deb
Size/MD5: 145582 7bbe9545270debdfbb783470aec52da3
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.7p5-1ubuntu4.2_powerpc.deb
Size/MD5: 153136 8de2ac3f51917aa5a7f036075567e68d
Updated packages for Ubuntu 5.04 (Hoary Hedgehog):
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.8p5-1ubuntu2.1.diff.gz
Size/MD5: 23451 560c7ca527526d804009152f1a64752f
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.8p5-1ubuntu2.1.dsc
Size/MD5: 585 024e53a1dc3320b92c3def3278e93b1b
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.8p5.orig.tar.gz
Size/MD5: 584832 03538d938b8593d6f1d66ec6c067b5b5
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.8p5-1ubuntu2.1_amd64.deb
Size/MD5: 170290 b730a59f092cbdf22fc3f0649ec55b7f
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.8p5-1ubuntu2.1_i386.deb
Size/MD5: 158592 6383525dc85c777200a0f90304dfef41
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.8p5-1ubuntu2.1_powerpc.deb
Size/MD5: 165296 3b4399b3149cde69961cb3a9140671a9
--3uo+9/B/ebqu+fSQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFCuBwODecnbV4Fd/IRAtanAJ4ws7jwM543QRubwfpoHCCPREveegCeIFXK
YU998kJwiGnWBISvipw5Vsc=
=RoxP
-----END PGP SIGNATURE-----
--3uo+9/B/ebqu+fSQ--
