From openpkg@openpkg.org Mon Jan 17 12:32:16 2005 From: OpenPKG To: bugtraq@securityfocus.com Date: Mon, 17 Jan 2005 13:29:50 +0100 Subject: [OpenPKG-SA-2005.002] OpenPKG Security Advisory (sudo) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org openpkg-security@openpkg.org openpkg@openpkg.org OpenPKG-SA-2005.002 17-Jan-2005 ________________________________________________________________________ Package: sudo Vulnerability: arbitrary code execution OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= sudo-1.6.8p1-20041104 >= sudo-1.6.8p2-20041112 OpenPKG 2.2 <= sudo-1.6.8p1-2.2.1 >= sudo-1.6.8p1-2.2.2 OpenPKG 2.1 <= sudo-1.6.7p5-2.1.1 >= sudo-1.6.7p5-2.1.2 Dependent Packages: none Description: Liam Helmer discovered a design flaw in Sudo [0], a program used to control user privilege escalation. The Sudo function rebuild_env() fails to sufficiently clean potentially dangerous variables from the environment passed to the program to be executed. An attacker with Sudo access to a shell script that uses GNU Bash may therefore run arbitrary commands with other (including superuser) privileges. The Common Vulnerabilities and Exposures (CVE) project assigned the identifier CAN-2004-1051 [1] to the problem. Please check whether you are affected by running "/bin/openpkg rpm -q sudo". If you have the "sudo" package installed and its version is affected (see above), we recommend that you immediately upgrade it (see Solution) [2][3]. Workaround: Add a line to the sudoers file containing the text 'Defaults env_reset'. This causes the environment to only contain the variables HOME, LOGNAME, PATH, SHELL, TERM, and USER, thus preventing an attack. Solution: Select the updated source RPM appropriate for your OpenPKG release [4][5], fetch it from the OpenPKG FTP service [6][7] or a mirror location, verify its integrity [8], build a corresponding binary RPM from it [2] and update your OpenPKG installation by applying the binary RPM [3]. For the most recent release OpenPKG 2.2, perform the following operations to permanently fix the security problem (for other releases adjust accordingly). $ ftp ftp.openpkg.org ftp> bin ftp> cd release/2.2/UPD ftp> get sudo-1.6.8p1-2.2.2.src.rpm ftp> bye $ /bin/openpkg rpm -v --checksig sudo-1.6.8p1-2.2.2.src.rpm $ /bin/openpkg rpm --rebuild sudo-1.6.8p1-2.2.2.src.rpm $ su - # /bin/openpkg rpm -Fvh /RPM/PKG/sudo-1.6.8p1-2.2.2.*.rpm ________________________________________________________________________ References: [0] http://www.sudo.ws/ [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1051 [2] http://www.openpkg.org/tutorial.html#regular-source [3] http://www.openpkg.org/tutorial.html#regular-binary [4] ftp://ftp.openpkg.org/release/2.2/UPD/sudo-1.6.8p1-2.2.2.src.rpm [5] ftp://ftp.openpkg.org/release/2.1/UPD/sudo-1.6.7p5-2.1.2.src.rpm [6] ftp://ftp.openpkg.org/release/2.2/UPD/ [7] ftp://ftp.openpkg.org/release/2.1/UPD/ [8] http://www.openpkg.org/security.html#signature ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG " (ID 63C4CB9F) of the OpenPKG project which you can retrieve from http://pgp.openpkg.org and hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/ for details on how to verify the integrity of this advisory. ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG iD8DBQFB66+ugHWT4GPEy58RAmbnAKD11oxrYLF/oKusAvLc7yhY606SDwCgyPFc NlNjIk/xso2hVQ17fKfCKbA= =kozt -----END PGP SIGNATURE-----