MDVSA-2011:018

Package name
sudo
Date
2011-01-21
Advisory ID
MDVSA-2011:018
Affected versions
2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.1 i586 , 2010.0 i586 , 2009.0 i586 , MES5 x86_64 , 2010.1 x86_64

Problem description

Multiple vulnerabilities has been found and corrected in sudo:

A a patch for parse.c in sudo does not properly interpret a system
group (aka %group) in the sudoers file during authorization decisions
for a user who belongs to that group, which allows local users to
leverage an applicable sudoers file and gain root privileges via a sudo
command. NOTE: this vulnerability exists because of a CVE-2009-0034
regression (CVE-2011-0008).

check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured,
does not require a password for command execution that involves a
gid change but no uid change, which allows local users to bypass an
intended authentication requirement via the -g option to a sudo command
(CVE-2011-0010).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been upgraded to the latest versions
(1.7.4p6) which is not affected by these issues.

Updated packages

2009.0 x86_64

 abbbaeda5baa10b2fb5b9dbabbf7876d  2009.0/x86_64/sudo-1.7.4p6-0.1mdv2009.0.x86_64.rpm 
 b458afb1e2d4bf6a9a3f946baef66fb8  2009.0/SRPMS/sudo-1.7.4p6-0.1mdv2009.0.src.rpm

MES5 i586

 c03ff4f1c811e18a3a400ada52a8300d  mes5/i586/sudo-1.7.4p6-0.1mdvmes5.1.i586.rpm 
 945432ec0af5e430e9e428def438e295  mes5/SRPMS/sudo-1.7.4p6-0.1mdvmes5.1.src.rpm

2010.0 x86_64

 402b755280cab7a5240b5e26f463d35a  2010.0/x86_64/sudo-1.7.4p6-0.1mdv2010.0.x86_64.rpm 
 2fb1abfa36749d38d986292269fa2ace  2010.0/SRPMS/sudo-1.7.4p6-0.1mdv2010.0.src.rpm

2010.1 i586

 2b8f0a4167c5e7d9e5225d635ed8acdc  2010.1/i586/sudo-1.7.4p6-0.1mdv2010.2.i586.rpm 
 d6997b0444b370736a193546a81c7d06  2010.1/SRPMS/sudo-1.7.4p6-0.1mdv2010.2.src.rpm

2010.0 i586

 5a90501c30b2bdbf0fe8875968f03342  2010.0/i586/sudo-1.7.4p6-0.1mdv2010.0.i586.rpm 
 2fb1abfa36749d38d986292269fa2ace  2010.0/SRPMS/sudo-1.7.4p6-0.1mdv2010.0.src.rpm

2009.0 i586

 f85924e31c3d3b3603373c9c28760046  2009.0/i586/sudo-1.7.4p6-0.1mdv2009.0.i586.rpm 
 b458afb1e2d4bf6a9a3f946baef66fb8  2009.0/SRPMS/sudo-1.7.4p6-0.1mdv2009.0.src.rpm

MES5 x86_64

 3bd5e4ddc536d59ea206a8450c780bbc  mes5/x86_64/sudo-1.7.4p6-0.1mdvmes5.1.x86_64.rpm 
 945432ec0af5e430e9e428def438e295  mes5/SRPMS/sudo-1.7.4p6-0.1mdvmes5.1.src.rpm

2010.1 x86_64

 8399b03348c79e9a1bfb5566f0e33aee  2010.1/x86_64/sudo-1.7.4p6-0.1mdv2010.2.x86_64.rpm 
 d6997b0444b370736a193546a81c7d06  2010.1/SRPMS/sudo-1.7.4p6-0.1mdv2010.2.src.rpm

References