Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - added patch for CVE-2014-0106: certain environment     variables not sanitized when env_reset is disabled     Resolves: rhbz#1072210

  - backported fixes for CVE-2013-1775 CVE-2013-1776     (CVE-2013-2776) CVE-2013-2777 Resolves: rhbz#968221

  - visudo: fixed incorrect warning and parse error     regarding undefined aliases which were in fact defined     Resolves: rhbz#849679 Resolves: rhbz#905624

  - updated sudoers man-page to clarify the behavior of the     user negation operator and the behavior of wildcard     matching in command specifications Resolves: rhbz#846118     Resolves: rhbz#856902

  - fixed regression in escaping of sudo -i arguments     Resolves: rhbz#853203

  - bump release number

  - Fixed caching of user and group names

  - Backported RFC 4515 escaping of LDAP queries Resolves:
    rhbz#855836 Resolves: rhbz#869287

  - Add the -c option to sed commands in post/postun scripts     Resolves: rhbz#818585

  - Implement a new sudoers Defaults option to restore old     command exec behavior Resolves: rhbz#840971

  - Add ability to treat files authoritatively in     sudoers.ldap Resolves: rhbz#840097

  - Changed policycoreutils dependency to a context specific     dependency (post & postun) Resolves: rhbz#846694

  - don't use a temporary file when modifying nsswitch.conf

  - fix permissions on nsswitch.conf, if needed Resolves:
    rhbz#846631

  - added a workaround for a race condition in handling     child processes Resolves: rhbz#829263

  - use safe temporary files in post/postun scripts

  - corrected postun script Resolves: rhbz#841070

  - corrected release number

  - call restorecon after modifying nsswitch.conf in the     postun scriplet

  - added policycoreutils dependency Resolves: rhbz#818585

  - fixed `sudo -i' command escaping (#806073)

  - fixed multiple sudoHost LDAP attr. handlng (#740884)     Resolves: rhbz#740884 Resolves: rhbz#806073

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update fixes the CVEs described below.

CVE-2014-0106

Todd C. Miller reported that if the env_reset option is disabled in the sudoers file, the env_delete option is not correctly applied to environment variables specified on the command line. A malicious user with sudo permissions may be able to run arbitrary commands with elevated privileges by manipulating the environment of a command the user is legitimately allowed to run.

CVE-2014-9680

Jakub Wilk reported that sudo preserves the TZ variable from a user's environment without any sanitization. A user with sudo access may take advantage of this to exploit bugs in the C library functions which parse the TZ environment variable or to open files that the user would not otherwise be able to open. The latter could potentially cause changes in system behavior when reading certain device special files or cause the program run via sudo to block.

For the oldstable distribution (squeeze), these problems have been fixed in version 1.7.4p4-2.squeeze.5.

For the stable distribution (wheezy), they have been fixed in version 1.8.5p2-1+nmu2.

We recommend that you upgrade your sudo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-30 (sudo: Privilege escalation)

    When the Sudo env_reset option is disabled (it is enabled by default),       certain environment variables are not blacklisted as expected.
  Impact :

    A local attacker, authorized to run commands using sudo, can use this       flaw to execute arbitrary code or escalate his privileges.
  Workaround :

    There is no known workaround at this time.

This collective update for sudo provides fixes for the following issues :

  - Security policy bypass when env_reset is disabled.
    (CVE-2014-0106, bnc#866503)

  - Regression in the previous update that causes a     segmentation fault when running 'sudo -s'. (bnc#868444)

  - Command 'who -m' prints no output when using     log_input/log_output sudo options. (bnc#863025)

Sebastien Macke discovered that Sudo incorrectly handled blacklisted environment variables when the env_reset option was disabled. A local attacker could use this issue to possibly run unintended commands by using blacklisted environment variables. In a default Ubuntu installation, the env_reset option is enabled by default. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2014-0106)

It was discovered that the Sudo init script set a date in the past on existing timestamp files instead of using epoch to invalidate them completely. A local attacker could possibly modify the system time to attempt to reuse timestamp files. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. (LP: #1223297).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way sudo handled its blacklist of environment variables. When the 'env_reset' option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an arbitrary command with the target user's privileges. (CVE-2014-0106)

Note: This issue does not affect the default configuration of the sudo package as shipped with Scientific Linux 5.

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled its blacklist of environment variables. When the 'env_reset' option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an arbitrary command with the target user's privileges. (CVE-2014-0106)

Note: This issue does not affect the default configuration of the sudo package as shipped with Red Hat Enterprise Linux 5.

Red Hat would like to thank Todd C. Miller for reporting this issue.
Upstream acknowledges Sebastien Macke as the original reporter.

All sudo users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

From Red Hat Security Advisory 2014:0266 :

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root.

A flaw was found in the way sudo handled its blacklist of environment variables. When the 'env_reset' option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an arbitrary command with the target user's privileges. (CVE-2014-0106)

Note: This issue does not affect the default configuration of the sudo package as shipped with Red Hat Enterprise Linux 5.

Red Hat would like to thank Todd C. Miller for reporting this issue.
Upstream acknowledges Sebastien Macke as the original reporter.

All sudo users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

New sudo packages are available for Slackware 13.0, 13.1, and 13.37 to fix a security issue.

ID	Name	Product	Family	Severity
91755	OracleVM 3.2 : sudo (OVMSA-2016-0079)	Nessus	OracleVM Local Security Checks	medium
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
82144	Debian DLA-160-1 : sudo security update	Nessus	Debian Local Security Checks	low
76287	GLSA-201406-30 : sudo: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
73327	SuSE 11.3 Security Update : sudo (SAT Patch Number 9044)	Nessus	SuSE Local Security Checks	medium
73016	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : sudo vulnerabilities (USN-2146-1)	Nessus	Ubuntu Local Security Checks	medium
72924	Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20140310)	Nessus	Scientific Linux Local Security Checks	medium
72923	RHEL 5 : sudo (RHSA-2014:0266)	Nessus	Red Hat Local Security Checks	medium
72922	Oracle Linux 5 : sudo (ELSA-2014-0266)	Nessus	Oracle Linux Local Security Checks	medium
72910	CentOS 5 : sudo (CESA-2014:0266)	Nessus	CentOS Local Security Checks	medium
72838	Slackware 13.0 / 13.1 / 13.37 : sudo (SSA:2014-064-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2014-0106

high

Tenable Plugins

medium

high

high

low

medium

medium

medium

medium

medium

medium

medium

medium