CVE-2016-7032

sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.

These are all security issues fixed in the sudo-1.9.7p2-1.4 package on the GA media of openSUSE Tumbleweed.

This update for sudo fixes the following issues:

• Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:

  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

• The SSSD plugin would occasionally crash sudo with an 'internal error'. This issue has been fixed. [bsc#948973]

• The SSSD plugin would occasionally apply @netgroups rules from LDAP to all users rather than the @netgroup. This issue is now fixed. [bsc#966755]

• When the SSSD plugin was used and a local user ran sudo, an e-mail used to be sent to administrator because SSSD did not support sudo rules for local users. This message did not signify an error, however, it was only noise. [bsc#1008043]

This update for sudo fixes the following issues:

• fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

This update for sudo fixes the following security issues:

• Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
  • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]
• Fix unsafe handling of TZ environment variable. [CVE-2014-9680, bsc#917806]

Additionally, these non-security fixes are included in the update:

• Fix 'ignoring time stamp from the future' message after each boot with !tty_tickets. [bsc#899252]
• Enable support for SASL-based authentication. [bsc#979531]

USN-3968-1 fixed several vulnerabilities in Sudo. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use this issue to bypass configured restrictions and execute arbitrary commands. (CVE-2016-7076, CVE-2016-7032)