Executive brief
A vulnerability in the sudo utility allows local users to bypass security restrictions and run unauthorized commands. By using specific file path techniques, an attacker can trick the system into executing programs that they are normally forbidden from using. This could lead to a complete takeover of the affected system by a standard user.
Technical details
A path traversal vulnerability exists in sudo versions 1.5.x due to improper validation of command paths. When sudo is configured with exclusion lists, it fails to properly normalize or account for relative directory entries (e.g., '../../'). A local attacker can bypass the access control list by specifying a command using '..' sequences, allowing the execution of arbitrary binaries with elevated privileges. This issue is particularly impactful on configurations relying on command exclusions rather than explicit inclusions.
Affected products
- Sudo Project sudo 1.5.x
Timeline
- 1997-12-23: disclosed: Reported to sudo-bugs mailing list.
- 1998-01-12: advisory: Public disclosure on Bugtraq.