• info
• discussion
• exploit
• solution
• references

Todd Miller Sudo 'Runas_Alias' Supplementary Group Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.


OpenBSD OpenBSD 4.3

• OpenBSD 011_sudo.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/011_sudo.patch

MandrakeSoft Linux Mandrake 2008.1 x86_64

• Mandriva sudo-1.6.9p13-1.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.1

• Mandriva sudo-1.6.9p13-1.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu sudo_1.6.9p10-1ubuntu3.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p10-1ubuntu3.4_powe rpc.deb


• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_powerpc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p10-1ubunt u3.4_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu sudo_1.6.9p17-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p17-1ubuntu2.1_powe rpc.deb


• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p17-1ubunt u2.1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu sudo_1.6.9p17-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p17-1ubun tu2.1_i386.deb


• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p17-1ubuntu2.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_sparc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p10-1ubunt u3.4_sparc.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_sparc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p10-1ubuntu3.4_spar c.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva sudo-1.7.4p6-0.1mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.0 x86_64

• Mandriva sudo-1.6.9p5-1.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p10-1ubuntu3.4_amd64.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p10-1ubun tu3.4_amd64.deb

MandrakeSoft Enterprise Server 5

• Mandriva sudo-1.7.4p6-0.1mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.0

• Mandriva sudo-1.6.9p5-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2010.1 x86_64

• Mandriva sudo-1.7.4p6-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/

OpenBSD OpenBSD 4.4

• OpenBSD 011_sudo.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.4/common/011_sudo.patch

MandrakeSoft Linux Mandrake 2010.0

• Mandriva sudo-1.7.4p6-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_lpia.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p10-1ubunt u3.4_lpia.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_lpia.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p10-1ubuntu3.4_lpia .deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p17-1ubunt u2.1_lpia.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p17-1ubuntu2.1_lpia .deb

MandrakeSoft Linux Mandrake 2010.0 x86_64

• Mandriva sudo-1.7.4p6-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/s/sudo/sudo-ldap_1.6.9p17-1ubunt u2.1_sparc.deb


• Ubuntu sudo_1.6.9p17-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/s/sudo/sudo_1.6.9p17-1ubuntu2.1_spar c.deb

MandrakeSoft Linux Mandrake 2010.1

• Mandriva sudo-1.7.4p6-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2009.0

• Mandriva sudo-1.7.4p6-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva sudo-1.6.9p17-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu sudo-ldap_1.6.9p10-1ubuntu3.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p10-1ubuntu3.4_i386.deb


• Ubuntu sudo_1.6.9p10-1ubuntu3.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p10-1ubun tu3.4_i386.deb

MandrakeSoft Linux Mandrake 2009.0 x86_64

• Mandriva sudo-1.6.9p17-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva sudo-1.7.4p6-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

VMWare ESX Server 4.0

• VMWare ESX400-200906001
  http://tinyurl.com/ncfu5s

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu sudo_1.6.9p17-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.6.9p17-1ubun tu2.1_amd64.deb


• Ubuntu sudo-ldap_1.6.9p17-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/s/sudo/sudo-ldap_1.6.9 p17-1ubuntu2.1_amd64.deb