Bug 40365 – sudo: multiple issues (4.0)

Bug 40365 - sudo: multiple issues (4.0)


Summary:	sudo: multiple issues (4.0)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.0-4-errata
Assigned To:	Arvid Requate
QA Contact:	Daniel Tröder

URL:
Keywords:

Depends on:	40364
Blocks:	40366
	Show dependency tree / graph

Reported:	2016-01-05 11:45 CET by Arvid Requate
Modified:	2016-03-08 17:32 CET (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:

Flags:	requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2016-01-05 11:45:23 CET

+++ This bug was initially created as a clone of Bug #40364 +++

CVE-2015-5602: sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."

Comment 1 Arvid Requate

2016-01-11 20:10:41 CET

Upstream Debian package version 1.8.5p2-1+nmu3+deb7u1 fixes this issue.

Comment 2 Arvid Requate

2016-02-29 20:14:48 CET

The patches have been extracted from the Debian package update and the package has been rebuilt with them in errata4.0-4.

Advisory: sudo.yaml

Comment 3 Daniel Tröder

2016-03-02 13:24:39 CET

OK: advisory
OK: manual test of exploit:

root@dc2000:~# DEBIAN_FRONTEND=noninteractive apt-get install sudo
root@dc2000:~# dpkg -l sudo
ii  sudo                        1.8.5p2-1+nmu2.39. amd64
root@dc2000:~# echo 'schueler1 ALL=(root) NOPASSWD: sudoedit /home/*/*/test.txt' >> /etc/sudoers
schueler1@dc2000:~$ sudoedit /home/schueler1/testdir/test.txt
sudoedit: /home/schueler1/testdir/test.txt unchanged
schueler1@dc2000:~$ logout
root@dc2000:~# apt-get update
root@dc2000:~# dpkg -l sudo
ii  sudo                        1.8.5p2-1+nmu2.41. amd64
root@dc2000:~# su - schueler1
schueler1@dc2000:~$ sudoedit /home/schueler1/testdir/test.txt
sudoedit: /home/schueler1/testdir/test.txt: editing files in a writable directory is not permitted

Comment 4 Janek Walkenhorst

2016-03-08 17:32:07 CET

<http://errata.software-univention.de/ucs/4.0/406.html>