CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

Updated sudo packages fix security vulnerability:

Prior to sudo 1.8.12, the TZ environment variable was passed through unchecked. Most libc tzset() implementations support passing an absolute pathname in the time zone to point to an arbitrary, user-controlled file. This may be used to exploit bugs in the C library's TZ parser or open files the user would not otherwise have access to. Arbitrary file access via TZ could also be used in a denial of service attack by reading from a file or fifo that will block (CVE-2014-9680).

The sudo package has been updated to version 1.8.12, fixing this issue and several other bugs.

These are all security issues fixed in the sudo-1.9.7p2-1.4 package on the GA media of openSUSE Tumbleweed.

This collective update for sudo provides fixes for the following issues:

* Security policy bypass when env_reset is disabled. (CVE-2014-0106,
  bnc#866503)
* Regression in the previous update that causes a segmentation fault
  when running 'sudo -s'. (bnc#868444)
* Command 'who -m' prints no output when using log_input/log_output
  sudo options. (bnc#863025)

Security Issues references:

* CVE-2014-0106
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106>

This update for sudo fixes the following security issues:

• Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]
• Fix unsafe handling of TZ environment variable. [CVE-2014-9680, bsc#917806]

Additionally, these non-security fixes are included in the update:

• Fix 'ignoring time stamp from the future' message after each boot with !tty_tickets. [bsc#899252]
• Enable support for SASL-based authentication. [bsc#979531]

Jakub Wilk and Stephane Chazelas discovered that Sudo incorrectly handled the TZ environment variable. An attacker with Sudo access could possibly use this issue to open arbitrary files, bypassing intended permissions.