Security bugs are reported here via bugzilla

[Thomas Houssin <Thomas.Houssin AT gmail.com>]

original security alert :
http://www.courtesan.com/sudo/alerts/path_race.html

Synopsis
========
A race condition in Sudo's command pathname handling prior to Sudo
version 1.6.8p9 that could allow a user with Sudo privileges to run
arbitrary commands.

Background
==========
Sudo (superuser do) allows a system administrator to give certain users
(or groups of users) the ability to run some (or all) commands as root
while logging all commands and arguments. Sudo operates on a per-command
basis, it is not a replacement for the shell.

Description
===========
When a user runs a command via Sudo, the inode and device numbers of the
command are compared to those of commands with the same basename found
in the sudoers file (see the Background section for more information).
When a match is found, the path to the matching command listed in the
sudoers file is stored in the variable safe_cmnd, which is later used to
execute the command. Because the actual path executed comes from the
sudoers file and not directly from the user, Sudo should be safe from
race conditions involving symbolic links. However, if a sudoers entry
containing the pseudo-command ALL follows the user's sudoers entry the
contents of safe_cmnd will be overwritten with the path the user
specified on the command line, making Sudo vulnerable to the
aforementioned race condition.

Impact
======
Exploitation of the bug requires that the user be allowed to run one or
more commands via Sudo and be able to create symbolic links in the
filesystem. Furthermore, a sudoers entry giving another user access to
the ALL pseudo-command must follow the user's sudoers entry for the race
to exist.

For example, the following sudoers file is not affected by the bug:

root            server=ALL
someuser        server=/bin/echo

Whereas this one would be:

someuser        server=/bin/echo
root            server=ALL

Affected packages
=================
sudo in all grimoires (devel, test, stable-rc and stable) is affected.
This is now fixed in all grimoires (sudo updated to 1.6.8p9).

Resolution
==========
All sudo users should upgrade to the latest available version:
        # scribe update
        # cast -c sudo

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature