From Todd.Miller at courtesan.com  Mon Jan 30 10:37:24 2012
From: Todd.Miller at courtesan.com (Todd C. Miller)
Date: Mon, 30 Jan 2012 10:37:24 -0500
Subject: [sudo-announce] Security flaw in sudo versions 1.8.0 through 1.8.3p1
Message-ID: <201201301537.q0UFbOfb008746@core.courtesan.com>

Summary:

A flaw exists in the debugging code in sudo versions 1.8.0 through
1.8.3p1 that can be used to crash sudo or potentially allow an
unauthorized user to elevate privileges.

Sudo versions affected:

1.8.0 through 1.8.3p1 inclusive.  Older versions of sudo are not
affected.

CVE ID:

This vulnerability has been assigned CVE 2012-0809 in the Common
Vulnerabilities and Exposures database.

Details:

Sudo 1.8.0 introduced simple debugging support that was primarily
intended for use when developing policy or I/O logging plugins.
The sudo_debug() function contains a flaw where the program name
is used as part of the format string passed to the fprintf() function.
The program name can be controlled by the caller, either via a
symbolic link or, on some systems, by setting argv[0] when executing
sudo.  For example:

    $ ln -s /usr/bin/sudo ./%s
    $ ./%s -D9
    Segmentation fault

Using standard format string vulnerability exploitation techniques
it is possible to leverage this bug to achieve root privileges.

Impact:

Successful exploitation of the bug will allow a user to run arbitrary
commands as root.

Exploitation of the bug does *not* require that the attacker be
listed in the sudoers file.  As such, we strongly suggest that
affected sites upgrade from affected sudo versions as soon as
possible.

Workaround:

On systems that support FORTIFY_SOURCE (most Linux and NetBSD),
adding -D_FORTIFY_SOURCE=2 to the OSDEFS line in src/Makfile and
then rebuilding sudo will prevent the bug from being exploited.

Fix:

The bug is fixed in sudo 1.8.3p2.  Sudo version 1.8.3p1 may be
updated to version 1.8.3p2 via the file sudo-1.8.3p2.patch.gz.  For
sudo versions 1.8.0-1.8.3, the patch to sudo.c in sudo-1.8.3p2.patch.gz
will also apply.

Files:

http://www.sudo.ws/sudo/dist/sudo-1.8.3p2.tar.gz
http://www.sudo.ws/sudo/dist/sudo-1.8.3p2.patch.gz
ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.3p2.tar.gz
ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.3p2.patch.gz

Credit:

Thanks to joernchen of Phenoelit for finding and reporting the bug.