CVE-2016-7076

sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges (CVE-2016-7076).

These are all security issues fixed in the sudo-1.9.7p2-1.4 package on the GA media of openSUSE Tumbleweed.

This update for sudo fixes the following issues:

• Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:

  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

• The SSSD plugin would occasionally crash sudo with an 'internal error'. This issue has been fixed. [bsc#948973]

• The SSSD plugin would occasionally apply @netgroups rules from LDAP to all users rather than the @netgroup. This issue is now fixed. [bsc#966755]

• When the SSSD plugin was used and a local user ran sudo, an e-mail used to be sent to administrator because SSSD did not support sudo rules for local users. This message did not signify an error, however, it was only noise. [bsc#1008043]

This update for sudo fixes the following issues:

• fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

This update for sudo fixes the following security issues:

• Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]
• Fix unsafe handling of TZ environment variable. [CVE-2014-9680, bsc#917806]

Additionally, these non-security fixes are included in the update:

• Fix 'ignoring time stamp from the future' message after each boot with !tty_tickets. [bsc#899252]
• Enable support for SASL-based authentication. [bsc#979531]

Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use this issue to bypass configured restrictions and execute arbitrary commands. (CVE-2016-7076)

It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwrite any file on the filesystem, bypassing intended permissions. (CVE-2017-1000368)

USN-3968-1 fixed several vulnerabilities in Sudo. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use this issue to bypass configured restrictions and execute arbitrary commands. (CVE-2016-7076, CVE-2016-7032)