February 22, 2010
A flaw exists in sudo's -e option (aka sudoedit) in sudo versions
1.6.9 through 1.7.2p3 that may give a user with permission to run
sudoedit the ability to run arbitrary commands.
Sudo versions affected:
1.6.9 through 1.7.2p3 inclusive.
This vulnerability has been assigned CVE-2010-0426
in the Common
Vulnerabilities and Exposures
When sudo performs its command matching, there is a special case
for pseudo-commands in the sudoers file (currently, the only
pseudo-command is sudoedit). Unlike a regular command, pseudo-commands
do not begin with a slash ('/').
The flaw is that sudo's the matching code would only check against
the list of pseudo-commands if the user-specified command also
contained no slashes. As a result, if the user ran "sudo ./sudoedit"
the normal matching code path was followed, which uses stat(2) to
verify that the user-specified command matches the one in sudoers.
In this case, it would compare the "./sudoedit" specified by the
user with "sudoedit" from the sudoers file, resulting in a positive
Exploitation of the bug requires that the sudoers file be configured
to allow the attacker to run sudoedit. If no users have been granted
access to sudoedit there is no impact.
Successful exploitation of the bug will allow a user to run arbitrary
commands for whichever user they have permission to run sudoedit
as, typically root.
The bug is fixed in sudo 1.7.2p4 and 1.6.9p21
This problem was brought to my attention by Glenn Waller and neonsignal.
Sudo bug #389