--------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated sudo packages fix security issue Advisory ID: FLSA:162750 Issue date: 2006-02-23 Product: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CVE-2005-1993 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: An updated sudo package is available that fixes a race condition in sudo's pathname validation. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root with logging. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: A race condition bug was found in the way sudo handles pathnames. It is possible that a local user with limited sudo access could create a race condition that would allow the execution of arbitrary commands as the root user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1993 to this issue. Users of sudo should update to this updated package, which contains a backported patch and is not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162750 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/sudo-1.6.5p2-2.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/sudo-1.6.5p2-2.3.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/sudo-1.6.6-3.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/sudo-1.6.6-3.3.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/sudo-1.6.7p5-2.3.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/sudo-1.6.7p5-2.3.legacy.i386.rpm Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/sudo-1.6.7p5-26.2.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/sudo-1.6.7p5-26.2.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- 5eed8171a2be78f8a03de987b86220b1c8ecb9d4 redhat/7.3/updates/i386/sudo-1.6.5p2-2.3.legacy.i386.rpm f1fdc4b82456cf66f89764ec7f9c0909a0603805 redhat/7.3/updates/SRPMS/sudo-1.6.5p2-2.3.legacy.src.rpm 7a84e2d96bba56142ca8c6dec2603577e31b2072 redhat/9/updates/i386/sudo-1.6.6-3.3.legacy.i386.rpm 4aca97be1c9e5f61efa1165955eb219fce3af70e redhat/9/updates/SRPMS/sudo-1.6.6-3.3.legacy.src.rpm 4e7b55e41c355e51b4cdd3a820a6d5c94df43fdc fedora/1/updates/i386/sudo-1.6.7p5-2.3.legacy.i386.rpm 6843f6ee7792e8c63f1034107a4a4e464a613798 fedora/1/updates/SRPMS/sudo-1.6.7p5-2.3.legacy.src.rpm 954a6e7098b7e86e7bc1f1532a72f8a3dab32380 fedora/2/updates/i386/sudo-1.6.7p5-26.2.legacy.i386.rpm 82c884d6bcff123dd510ffdb8a0d81ce63606364 fedora/2/updates/SRPMS/sudo-1.6.7p5-26.2.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1993 9. Contact: The Fedora Legacy security contact is <secnotice@xxxxxxxxxxxxxxxx>. More project details at http://www.fedoralegacy.org ---------------------------------------------------------------------
Attachment:
signature.asc
Description: OpenPGP digital signature