sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.

Previous sudo updates were made available to sanitize certain environment variables from affecting a sudo call, such as PYTHONINSPECT, PERL5OPT, etc. While those updates were effective in addressing those specific environment variables, other variables that were not blacklisted were being made available.

Debian addressed this issue by forcing sudo to use a whitlist approach in DSA-946-2 by arbitrarily making env_reset the default (as opposed to having to be enabled in /etc/sudoers). Mandriva has opted to follow the same approach so now only certain variables are, by default, made available, such as HOME, LOGNAME, SHELL, TERM, DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER, as well as the SUDO_* variables.

If other variables are required to be kept, this can be done by editing /etc/sudoers and using the env_keep option, such as :

Defaults env_keep='FOO BAR'

As well, the Corporate 3 packages are now compiled with the SECURE_PATH setting.

Updated packages are patched to address this issue.

The former correction to vulnerabilities in the sudo package worked fine but were too strict for some environments. Therefore we have reviewed the changes again and allowed some environment variables to go back into the privileged execution environment. Hence, this update.

The configuration option 'env_reset' is now activated by default. It will preserve only the environment variables HOME, LOGNAME, PATH, SHELL, TERM, DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER in addition to the separate SUDO_* variables.

For completeness please find below the original advisory text :

  It has been discovered that sudo, a privileged program, that   provides limited super user privileges to specific users, passes   several environment variables to the program that runs with elevated   privileges. In the case of include paths (e.g. for Perl, Python,   Ruby or other scripting languages) this can cause arbitrary code to   be executed as privileged user if the attacker points to a   manipulated version of a system library.

  This update alters the former behaviour of sudo and limits the   number of supported environment variables to LC_*, LANG, LANGUAGE   and TERM. Additional variables are only passed through when set as   env_check in /etc/sudoers, which might be required for some scripts   to continue to work.

New sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue.

Charles Morris discovered a vulnerability in sudo versions prior to 1.6.8p12 where, when the perl taint flag is off, sudo does not clear the PERLLIB, PERL5LIB, and PERL5OPT environment variables, which could allow limited local users to cause a perl script to include and execute arbitrary library files that have the same name as library files that included by the script.

In addition, other environment variables have been included in the patch that remove similar environment variables that could be used in python and ruby, scripts, among others.

The updated packages have been patched to correct this problem.

ID	Name	Product	Family	Severity
23903	Mandrake Linux Security Advisory : sudo (MDKSA-2006:159)	Nessus	Mandriva Local Security Checks	high
22812	Debian DSA-946-2 : sudo - missing input sanitising	Nessus	Debian Local Security Checks	high
20919	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : sudo (SSA:2006-045-08)	Nessus	Slackware Local Security Checks	high
20465	Mandrake Linux Security Advisory : sudo (MDKSA-2005:234)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2006-0151

high

Tenable Plugins

high

high

high

high