ID

VAR-201303-0172

CVE

CVE-2013-1775

TITLE

sudo Vulnerabilities in which time restrictions can be bypassed

DESCRIPTION

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch. Todd Miller 'sudo' is prone to a local authentication-bypass vulnerability. A local attacker can exploit this issue to bypass authentication mechanism and gain unauthorized access. Successful exploits may lead to other attacks. This issue affects 'sudo' 1.6.0 through 1.7.10p6 and 'sudo' 1.8.0 through 1.8.6p6. Sudo is a set of programs developed by software developer Todd C. Miller for Unix-like operating systems and allows users to execute commands with special privileges in a secure manner. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+ patches/packages/sudo-1.8.6p7-i486-1_slack14.0.txz: Upgraded. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1776 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/sudo-1.7.10p7-i486-1_slack12.1.tgz Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/sudo-1.7.10p7-i486-1_slack12.2.tgz Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/sudo-1.7.10p7-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/sudo-1.7.10p7-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/sudo-1.7.10p7-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/sudo-1.7.10p7-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/sudo-1.7.10p7-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/sudo-1.7.10p7-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/sudo-1.8.6p7-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/sudo-1.8.6p7-x86_64-1_slack14.0.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/sudo-1.8.6p7-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/sudo-1.8.6p7-x86_64-1.txz MD5 signatures: +-------------+ Slackware 12.1 package: 16e47202f5cda7a372639fa6ef304974 sudo-1.7.10p7-i486-1_slack12.1.tgz Slackware 12.2 package: 6428965e88cac3b36a84bd3b1ab361a2 sudo-1.7.10p7-i486-1_slack12.2.tgz Slackware 13.0 package: 0251ce11992c06ba0e55a2a3f2e79d28 sudo-1.7.10p7-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 5352a19dbfdaad232573f4beb1b1237a sudo-1.7.10p7-x86_64-1_slack13.0.txz Slackware 13.1 package: 977a8fb54ae46ceaa037b52234f2bc2a sudo-1.7.10p7-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 4182726dc8cb4ba5b69a46daed686d04 sudo-1.7.10p7-x86_64-1_slack13.1.txz Slackware 13.37 package: 1af20762e5895338f38787e8f493d517 sudo-1.7.10p7-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 1af6f706de63704630087e1da3721ad7 sudo-1.7.10p7-x86_64-1_slack13.37.txz Slackware 14.0 package: d611a1f15bb379d078e04646172a626c sudo-1.8.6p7-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 580351ec41716ce1955468dbfaf95892 sudo-1.8.6p7-x86_64-1_slack14.0.txz Slackware -current package: ffb4636d9f772f441925079c4312a1fc ap/sudo-1.8.6p7-i486-1.txz Slackware x86_64 -current package: 66fa0b6eefbd9937ce7b4ac5e8c133c6 ap/sudo-1.8.6p7-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg sudo-1.8.6p7-i486-1_slack14.0.txz +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201401-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: sudo: Privilege escalation Date: January 21, 2014 Bugs: #459722 ID: 201401-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in sudo which could result in privilege escalation. Access to commands may also be granted on a range to hosts. * sudo does not properly handle the clock when it is set to the epoch. Workaround ========== There is no known workaround at this time. Resolution ========== All sudo users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.6_p7" References ========== [ 1 ] CVE-2013-1775 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1775 [ 2 ] CVE-2013-1776 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1776 [ 3 ] CVE-2013-2776 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2776 [ 4 ] CVE-2013-2777 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2777 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201401-23.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . ============================================================================ Ubuntu Security Notice USN-1754-1 February 28, 2013 sudo vulnerability ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: Sudo could be made to run programs as the administrator without a password prompt. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.10: sudo 1.8.5p2-1ubuntu1.1 sudo-ldap 1.8.5p2-1ubuntu1.1 Ubuntu 12.04 LTS: sudo 1.8.3p1-1ubuntu3.4 sudo-ldap 1.8.3p1-1ubuntu3.4 Ubuntu 11.10: sudo 1.7.4p6-1ubuntu2.2 sudo-ldap 1.7.4p6-1ubuntu2.2 Ubuntu 10.04 LTS: sudo 1.7.2p1-1ubuntu5.6 sudo-ldap 1.7.2p1-1ubuntu5.6 Ubuntu 8.04 LTS: sudo 1.6.9p10-1ubuntu3.10 sudo-ldap 1.6.9p10-1ubuntu3.10 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: sudo security, bug fix and enhancement update Advisory ID: RHSA-2013:1701-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1701.html Issue date: 2013-11-21 CVE Names: CVE-2013-1775 CVE-2013-2776 CVE-2013-2777 ===================================================================== 1. Summary: An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs: * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to "unlimited". (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name "root" was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements: * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 856901 - Defauts:!<user> syntax in sudoers doesn't seem to work as expected 880150 - sssd +netgroup sudoUser is always matched 886648 - Access granted with invalid sudoRunAsUser/sudoRunAsGroup 916363 - CVE-2013-1775 sudo: authentication bypass via reset system clock 949751 - CVE-2013-2776 sudo: bypass of tty_tickets constraints 949753 - CVE-2013-2777 sudo: bypass of tty_tickets constraints 994563 - Warning in visudo: cycle in Host_Alias even without cycle 994626 - sudo -u <user> sudo -l show error: *** glibc detected *** sudo: realloc(): invalid next size: 0x00007f4ae2d10ec0 *** 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm i386: sudo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.i686.rpm x86_64: sudo-1.8.6p3-12.el6.x86_64.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm i386: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm x86_64: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm x86_64: sudo-1.8.6p3-12.el6.x86_64.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm x86_64: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm i386: sudo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.i686.rpm ppc64: sudo-1.8.6p3-12.el6.ppc64.rpm sudo-debuginfo-1.8.6p3-12.el6.ppc64.rpm s390x: sudo-1.8.6p3-12.el6.s390x.rpm sudo-debuginfo-1.8.6p3-12.el6.s390x.rpm x86_64: sudo-1.8.6p3-12.el6.x86_64.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm i386: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm ppc64: sudo-debuginfo-1.8.6p3-12.el6.ppc.rpm sudo-debuginfo-1.8.6p3-12.el6.ppc64.rpm sudo-devel-1.8.6p3-12.el6.ppc.rpm sudo-devel-1.8.6p3-12.el6.ppc64.rpm s390x: sudo-debuginfo-1.8.6p3-12.el6.s390.rpm sudo-debuginfo-1.8.6p3-12.el6.s390x.rpm sudo-devel-1.8.6p3-12.el6.s390.rpm sudo-devel-1.8.6p3-12.el6.s390x.rpm x86_64: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm i386: sudo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.i686.rpm x86_64: sudo-1.8.6p3-12.el6.x86_64.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/sudo-1.8.6p3-12.el6.src.rpm i386: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm x86_64: sudo-debuginfo-1.8.6p3-12.el6.i686.rpm sudo-debuginfo-1.8.6p3-12.el6.x86_64.rpm sudo-devel-1.8.6p3-12.el6.i686.rpm sudo-devel-1.8.6p3-12.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-1775.html https://www.redhat.com/security/data/cve/CVE-2013-2776.html https://www.redhat.com/security/data/cve/CVE-2013-2777.html https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSjZCHXlSAg2UNWIIRAt3IAJ9vk5ycVQ6pYkHYc7uM6YLFvhsSrgCfVHi+ H0zICoykOf4KltShaykk1Wo= =z/lR -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:054 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : sudo Date : April 5, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in sudo: A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated netmask listed in the sudoers file or in LDAP. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2337 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1776 http://www.sudo.ws/sudo/alerts/netmask.html http://www.sudo.ws/sudo/alerts/epoch_ticket.html http://www.sudo.ws/sudo/alerts/tty_tickets.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 19aae8be2f1e4cc9d8e188a2d8147e99 mbs1/x86_64/sudo-1.8.3p2-2.1.mbs1.x86_64.rpm 13e0fd85e811c76b8863fa6d12889636 mbs1/x86_64/sudo-devel-1.8.3p2-2.1.mbs1.x86_64.rpm 922d319a0f3c78d10c1ca7be22141821 mbs1/SRPMS/sudo-1.8.3p2-2.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRXtnVmqjQ0CJFipgRAsBMAKCsU59xkkVcM4GANchnsdRDG+8srwCgkUwJ DXL0KGekk1VjbuhT941o/J8= =mpB4 -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

permissions and access control

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES