ID CVE-2012-3440
Summary A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file.
References
Vulnerable Configurations
  • Red Hat Enterprise Linux 5
    cpe:2.3:o:redhat:enterprise_linux:5
  • Todd Miller Sudo 1.7.2
    cpe:2.3:a:todd_miller:sudo:1.7.2
CVSS
Base: 5.6 (as of 08-08-2012 - 15:03)
Impact:
Exploitability:
CWE CWE-59
CAPEC
  • Symlink Attack
    An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
LOCAL HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE COMPLETE COMPLETE
nessus via4
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-1149.NASL
    description An updated sudo package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. An insecure temporary file use flaw was found in the sudo package's post-uninstall script. A local attacker could possibly use this flaw to overwrite an arbitrary file via a symbolic link attack, or modify the contents of the '/etc/nsswitch.conf' file during the upgrade or removal of the sudo package. (CVE-2012-3440) This update also fixes the following bugs : * Previously, sudo escaped non-alphanumeric characters in commands using 'sudo -s' or 'sudo -' at the wrong place and interfered with the authorization process. Some valid commands were not permitted. Now, non-alphanumeric characters escape immediately before the command is executed and no longer interfere with the authorization process. (BZ#844418) * Prior to this update, the sudo utility could, under certain circumstances, fail to receive the SIGCHLD signal when it was executed from a process that blocked the SIGCHLD signal. As a consequence, sudo could become suspended and fail to exit. This update modifies the signal process mask so that sudo can exit and sends the correct output. (BZ#844419) * The sudo update RHSA-2012:0309 introduced a regression that caused the Security-Enhanced Linux (SELinux) context of the '/etc/nsswitch.conf' file to change during the installation or upgrade of the sudo package. This could cause various services confined by SELinux to no longer be permitted to access the file. In reported cases, this issue prevented PostgreSQL and Postfix from starting. (BZ#842759) * Updating the sudo package resulted in the 'sudoers' line in '/etc/nsswitch.conf' being removed. This update corrects the bug in the sudo package's post-uninstall script that caused this issue. (BZ#844420) * Prior to this update, a race condition bug existed in sudo. When a program was executed with sudo, the program could possibly exit successfully before sudo started waiting for it. In this situation, the program would be left in a zombie state and sudo would wait for it endlessly, expecting it to still be running. (BZ#844978) All users of sudo are advised to upgrade to this updated package, which contains backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 61450
    published 2012-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61450
    title CentOS 5 : sudo (CESA-2012:1149)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20120808_SUDO_ON_SL5_X.NASL
    description An insecure temporary file use flaw was found in the sudo package's post-uninstall script. A local attacker could possibly use this flaw to overwrite an arbitrary file via a symbolic link attack, or modify the contents of the '/etc/nsswitch.conf' file during the upgrade or removal of the sudo package. (CVE-2012-3440) This update also fixes the following bugs : - Previously, sudo escaped non-alphanumeric characters in commands using 'sudo -s' or 'sudo -' at the wrong place and interfered with the authorization process. Some valid commands were not permitted. Now, non-alphanumeric characters escape immediately before the command is executed and no longer interfere with the authorization process. (BZ#844418) - Prior to this update, the sudo utility could, under certain circumstances, fail to receive the SIGCHLD signal when it was executed from a process that blocked the SIGCHLD signal. As a consequence, sudo could become suspended and fail to exit. This update modifies the signal process mask so that sudo can exit and sends the correct output. (BZ#844419) - The sudo update RHSA-2012:0309 introduced a regression that caused the Security-Enhanced Linux (SELinux) context of the '/etc/nsswitch.conf' file to change during the installation or upgrade of the sudo package. This could cause various services confined by SELinux to no longer be permitted to access the file. In reported cases, this issue prevented PostgreSQL and Postfix from starting. (BZ#842759) - Updating the sudo package resulted in the 'sudoers' line in '/etc/nsswitch.conf' being removed. This update corrects the bug in the sudo package's post-uninstall script that caused this issue. (BZ#844420) - Prior to this update, a race condition bug existed in sudo. When a program was executed with sudo, the program could possibly exit successfully before sudo started waiting for it. In this situation, the program would be left in a zombie state and sudo would wait for it endlessly, expecting it to still be running. (BZ#844978)
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61456
    published 2012-08-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61456
    title Scientific Linux Security Update : sudo on SL5.x i386/x86_64
  • NASL family Misc.
    NASL id VMWARE_ESX_VMSA-2013-0007_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of sudo : - An unspecified flaw exists in the sudo package related to the Network Matching Mechanism that is triggered when parsing IPv4 netmask hosts. A local attacker can exploit this to execute arbitrary code. (CVE-2012-2337) - An arbitrary file overwrite vulnerability exists in sudo due to a race condition occurs in post-uninstall during the upgrade or removal of sudo packages. A local attacker can exploit this via a symlink attack against the /var/tmp/nsswitch.conf.bak file, allowing the attacker write to a specified file. (CVE-2012-3440)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 89665
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89665
    title VMware ESX sudo Package Multiple Vulnerabilities (VMSA-2013-0007) (remote check)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2013-0007.NASL
    description a. Service Console update for sudo The service console package sudo is updated to version 1.7.2p1-14.el5_8.3 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-2337 and CVE-2012-3440 to the issues addressed in this update.
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 66723
    published 2013-05-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66723
    title VMSA-2013-0007 : VMware ESX third-party update for Service Console package sudo
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-1149.NASL
    description From Red Hat Security Advisory 2012:1149 : An updated sudo package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. An insecure temporary file use flaw was found in the sudo package's post-uninstall script. A local attacker could possibly use this flaw to overwrite an arbitrary file via a symbolic link attack, or modify the contents of the '/etc/nsswitch.conf' file during the upgrade or removal of the sudo package. (CVE-2012-3440) This update also fixes the following bugs : * Previously, sudo escaped non-alphanumeric characters in commands using 'sudo -s' or 'sudo -' at the wrong place and interfered with the authorization process. Some valid commands were not permitted. Now, non-alphanumeric characters escape immediately before the command is executed and no longer interfere with the authorization process. (BZ#844418) * Prior to this update, the sudo utility could, under certain circumstances, fail to receive the SIGCHLD signal when it was executed from a process that blocked the SIGCHLD signal. As a consequence, sudo could become suspended and fail to exit. This update modifies the signal process mask so that sudo can exit and sends the correct output. (BZ#844419) * The sudo update RHSA-2012:0309 introduced a regression that caused the Security-Enhanced Linux (SELinux) context of the '/etc/nsswitch.conf' file to change during the installation or upgrade of the sudo package. This could cause various services confined by SELinux to no longer be permitted to access the file. In reported cases, this issue prevented PostgreSQL and Postfix from starting. (BZ#842759) * Updating the sudo package resulted in the 'sudoers' line in '/etc/nsswitch.conf' being removed. This update corrects the bug in the sudo package's post-uninstall script that caused this issue. (BZ#844420) * Prior to this update, a race condition bug existed in sudo. When a program was executed with sudo, the program could possibly exit successfully before sudo started waiting for it. In this situation, the program would be left in a zombie state and sudo would wait for it endlessly, expecting it to still be running. (BZ#844978) All users of sudo are advised to upgrade to this updated package, which contains backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68595
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68595
    title Oracle Linux 5 : sudo (ELSA-2012-1149)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-1149.NASL
    description An updated sudo package that fixes one security issue and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. An insecure temporary file use flaw was found in the sudo package's post-uninstall script. A local attacker could possibly use this flaw to overwrite an arbitrary file via a symbolic link attack, or modify the contents of the '/etc/nsswitch.conf' file during the upgrade or removal of the sudo package. (CVE-2012-3440) This update also fixes the following bugs : * Previously, sudo escaped non-alphanumeric characters in commands using 'sudo -s' or 'sudo -' at the wrong place and interfered with the authorization process. Some valid commands were not permitted. Now, non-alphanumeric characters escape immediately before the command is executed and no longer interfere with the authorization process. (BZ#844418) * Prior to this update, the sudo utility could, under certain circumstances, fail to receive the SIGCHLD signal when it was executed from a process that blocked the SIGCHLD signal. As a consequence, sudo could become suspended and fail to exit. This update modifies the signal process mask so that sudo can exit and sends the correct output. (BZ#844419) * The sudo update RHSA-2012:0309 introduced a regression that caused the Security-Enhanced Linux (SELinux) context of the '/etc/nsswitch.conf' file to change during the installation or upgrade of the sudo package. This could cause various services confined by SELinux to no longer be permitted to access the file. In reported cases, this issue prevented PostgreSQL and Postfix from starting. (BZ#842759) * Updating the sudo package resulted in the 'sudoers' line in '/etc/nsswitch.conf' being removed. This update corrects the bug in the sudo package's post-uninstall script that caused this issue. (BZ#844420) * Prior to this update, a race condition bug existed in sudo. When a program was executed with sudo, the program could possibly exit successfully before sudo started waiting for it. In this situation, the program would be left in a zombie state and sudo would wait for it endlessly, expecting it to still be running. (BZ#844978) All users of sudo are advised to upgrade to this updated package, which contains backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 61452
    published 2012-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61452
    title RHEL 5 : sudo (RHSA-2012:1149)
redhat via4
advisories
bugzilla
id 844978
title Sudo has racecondition leaving sudo with its zombie child running forever
oval
AND
  • comment Red Hat Enterprise Linux 5 is installed
    oval oval:com.redhat.rhba:tst:20070331001
  • comment sudo is earlier than 0:1.7.2p1-14.el5_8.2
    oval oval:com.redhat.rhsa:tst:20121149002
  • comment sudo is signed with Red Hat redhatrelease key
    oval oval:com.redhat.rhsa:tst:20090267003
rhsa
id RHSA-2012:1149
released 2012-08-07
severity Moderate
title RHSA-2012:1149: sudo security and bug fix update (Moderate)
rpms sudo-0:1.7.2p1-14.el5_8.2
refmap via4
bid 54868
confirm
vmware via4
description The service console package sudo is updated to version 1.7.2p1-14.el5_8.3
id VMSA-2013-0007
last_updated 2013-12-05T00:00:00
published 2013-05-30T00:00:00
title Service Console update for sudo
Last major update 28-11-2016 - 14:08
Published 08-08-2012 - 06:26
Back to Top