-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2006-1 security@debian.org http://www.debian.org/security/ Giuseppe Iuculano March 02, 2010 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : sudo Vulnerability : several Problem type : local Debian-specific: no CVE Id(s) : CVE-2010-0426 CVE-2010-0427 Debian Bugs : 570737 Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users database server. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-0426: It was discovered that sudo when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file. CVE-2010-0427: It was discovered that sudo when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command. For the stable distribution (lenny), these problems have been fixed in version 1.6.9p17-2+lenny1 For the unstable distribution (sid), these problems have been fixed in version 1.7.2p1-1.2, and will migrate to the testing distribution (squeeze) shortly. We recommend that you upgrade your sudo package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1.diff.gz Size/MD5 checksum: 22997 9980866e257817e8281fd036141ccbd0 http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1.dsc Size/MD5 checksum: 1032 fc42a6b45a2e2c114c14cba892635d22 http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17.orig.tar.gz Size/MD5 checksum: 593534 60daf18f28e2c1eb7641c4408e244110 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_alpha.deb Size/MD5 checksum: 202898 6737769fc4f1e939c83eb228d29da8ab http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_alpha.deb Size/MD5 checksum: 189978 aed59dbcd7e7c23c5ebd6b76dda367b6 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_amd64.deb Size/MD5 checksum: 200664 a4611f65a8c2184fe6e245f72d0e9cb6 http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_amd64.deb Size/MD5 checksum: 188312 e8043d4e7b232ebf10fd56d6a8a271c1 arm architecture (ARM) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_arm.deb Size/MD5 checksum: 191750 47c1f36f12735a900be955ecd6ffed0c http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_arm.deb Size/MD5 checksum: 179806 e1c1ab5c915082dee797c3d2fa98bf0c armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_armel.deb Size/MD5 checksum: 179692 0435c6dc5dc0875a9213625d0e2e51f8 http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_armel.deb Size/MD5 checksum: 191068 8f167fb52ff3bfba4a22ef713c717b92 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_hppa.deb Size/MD5 checksum: 198430 260964e2ecaa461d87966b56b35972ae http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_hppa.deb Size/MD5 checksum: 185798 976f574ff1e528c4239d081a95e04989 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_i386.deb Size/MD5 checksum: 175988 3d63bc2bc801dbc5ad696a002a250c1f http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_i386.deb Size/MD5 checksum: 187528 70c225149240e5b20eae98ba82404de7 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_ia64.deb Size/MD5 checksum: 235314 df07cd07c083c673f316f541a1fedae6 http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_ia64.deb Size/MD5 checksum: 220036 4cb5d2a2a40f14b0c3029208ee15a8be mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_mipsel.deb Size/MD5 checksum: 197290 0ac1420accc8bf5e2272838f04a9f994 http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_mipsel.deb Size/MD5 checksum: 185476 3267192f0ae58a354041166b045d46f8 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_powerpc.deb Size/MD5 checksum: 201564 1df785382b20f29de5b212981a3cc9a1 http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_powerpc.deb Size/MD5 checksum: 187018 0d09fc441f760770e7d6557d3604d3e4 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_s390.deb Size/MD5 checksum: 186518 0ae97c76541b35b363b045cd8155b3aa http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_s390.deb Size/MD5 checksum: 199606 36ecd912df2c504c49d6db7533f59742 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/s/sudo/sudo_1.6.9p17-2+lenny1_sparc.deb Size/MD5 checksum: 180918 ae0eb27537d98dad6338b1b4cce891dd http://security.debian.org/pool/updates/main/s/sudo/sudo-ldap_1.6.9p17-2+lenny1_sparc.deb Size/MD5 checksum: 192640 9195914dfa0eb2a8306be4cfe88c6ce2 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAkuNduQACgkQNxpp46476aqgwwCfdrLLEO0kvD8Ac38dFsmJ7/H0 S5sAn1O9gZW5FfnBE3OkLNUnLwuJIzqe =zmQ8 -----END PGP SIGNATURE-----