Synopsis

Moderate: sudo security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

An updated sudo package that fixes one security issue and several bugs is
now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The sudo (superuser do) utility allows system administrators to give
certain users the ability to run commands as root.

An insecure temporary file use flaw was found in the sudo package's
post-uninstall script. A local attacker could possibly use this flaw to
overwrite an arbitrary file via a symbolic link attack, or modify the
contents of the "/etc/nsswitch.conf" file during the upgrade or removal of
the sudo package. (CVE-2012-3440)

This update also fixes the following bugs:

• Previously, sudo escaped non-alphanumeric characters in commands using
  "sudo -s" or "sudo -" at the wrong place and interfered with the
  authorization process. Some valid commands were not permitted. Now,
  non-alphanumeric characters escape immediately before the command is
  executed and no longer interfere with the authorization process.
  (BZ#844418)
  
• Prior to this update, the sudo utility could, under certain
  circumstances, fail to receive the SIGCHLD signal when it was executed
  from a process that blocked the SIGCHLD signal. As a consequence, sudo
  could become suspended and fail to exit. This update modifies the signal
  process mask so that sudo can exit and sends the correct output.
  (BZ#844419)
  
• The sudo update RHSA-2012:0309 introduced a regression that caused the
  Security-Enhanced Linux (SELinux) context of the "/etc/nsswitch.conf" file
  to change during the installation or upgrade of the sudo package. This
  could cause various services confined by SELinux to no longer be permitted
  to access the file. In reported cases, this issue prevented PostgreSQL and
  Postfix from starting. (BZ#842759)
  
• Updating the sudo package resulted in the "sudoers" line in
  "/etc/nsswitch.conf" being removed. This update corrects the bug in the
  sudo package's post-uninstall script that caused this issue. (BZ#844420)
  
• Prior to this update, a race condition bug existed in sudo. When a
  program was executed with sudo, the program could possibly exit
  successfully before sudo started waiting for it. In this situation, the
  program would be left in a zombie state and sudo would wait for it
  endlessly, expecting it to still be running. (BZ#844978)
  

All users of sudo are advised to upgrade to this updated package, which
contains backported patches to correct these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 842759 - selinux blocks postgresql startup
• BZ - 844420 - sudo 1.7.2p1-14.el5_8 removed sudoers line from nsswitch.conf
• BZ - 844442 - CVE-2012-3440 sudo: insecure temporary file use in RPM %postun script
• BZ - 844978 - Sudo has racecondition leaving sudo with its zombie child running forever

CVEs

• CVE-2012-3440

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://rhn.redhat.com/errata/RHSA-2012-0309.html

Red Hat Enterprise Linux Server 5

SRPM
sudo-1.7.2p1-14.el5_8.2.src.rpm	SHA-256: 067f25c4a99a5847ee82e21cf2c571648cbf0c2adc0df5ab15b0d71a1d238d28
x86_64
sudo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 02cc3e167cc3e0952095e26175967a9b2d1a0fc3ee9ee8a7eea097e82924204b
sudo-debuginfo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 9d0fd724a85d925569b10e3fa53a2052e482e5ee8096ba5e13fdf346f5f3f7c6
ia64
sudo-1.7.2p1-14.el5_8.2.ia64.rpm	SHA-256: e50b8e6a43f31b898434d2593c6725f3f742c8d9a8c00ecdb5992329022f3112
sudo-debuginfo-1.7.2p1-14.el5_8.2.ia64.rpm	SHA-256: 257812d458c9a101513b0ef57d20922fd0ae3360a799bb443fa6c6622ae500d8
i386
sudo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: ba523f2732f67949e972516a9a67a81e3393187c246d0a83b2eb48a224cc76e5
sudo-debuginfo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: 47e9c41e28fb5ba4d20b8b292ede3718f6aa56313e340c7c3a0ea2e6448d631b

Red Hat Enterprise Linux Workstation 5

SRPM
sudo-1.7.2p1-14.el5_8.2.src.rpm	SHA-256: 067f25c4a99a5847ee82e21cf2c571648cbf0c2adc0df5ab15b0d71a1d238d28
x86_64
sudo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 02cc3e167cc3e0952095e26175967a9b2d1a0fc3ee9ee8a7eea097e82924204b
sudo-debuginfo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 9d0fd724a85d925569b10e3fa53a2052e482e5ee8096ba5e13fdf346f5f3f7c6
i386
sudo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: ba523f2732f67949e972516a9a67a81e3393187c246d0a83b2eb48a224cc76e5
sudo-debuginfo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: 47e9c41e28fb5ba4d20b8b292ede3718f6aa56313e340c7c3a0ea2e6448d631b

Red Hat Enterprise Linux Desktop 5

SRPM
sudo-1.7.2p1-14.el5_8.2.src.rpm	SHA-256: 067f25c4a99a5847ee82e21cf2c571648cbf0c2adc0df5ab15b0d71a1d238d28
x86_64
sudo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 02cc3e167cc3e0952095e26175967a9b2d1a0fc3ee9ee8a7eea097e82924204b
sudo-debuginfo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 9d0fd724a85d925569b10e3fa53a2052e482e5ee8096ba5e13fdf346f5f3f7c6
i386
sudo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: ba523f2732f67949e972516a9a67a81e3393187c246d0a83b2eb48a224cc76e5
sudo-debuginfo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: 47e9c41e28fb5ba4d20b8b292ede3718f6aa56313e340c7c3a0ea2e6448d631b

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
sudo-1.7.2p1-14.el5_8.2.src.rpm	SHA-256: 067f25c4a99a5847ee82e21cf2c571648cbf0c2adc0df5ab15b0d71a1d238d28
s390x
sudo-1.7.2p1-14.el5_8.2.s390x.rpm	SHA-256: 52adaa13957f7817409987b82964a731902764f292abf4c4fe1dd8aa1208d9ad
sudo-debuginfo-1.7.2p1-14.el5_8.2.s390x.rpm	SHA-256: 593ed17698edc35682821ff06162b746d79a09cc1d59c96e8f5cc085f47348be

Red Hat Enterprise Linux for Power, big endian 5

SRPM
sudo-1.7.2p1-14.el5_8.2.src.rpm	SHA-256: 067f25c4a99a5847ee82e21cf2c571648cbf0c2adc0df5ab15b0d71a1d238d28
ppc
sudo-1.7.2p1-14.el5_8.2.ppc.rpm	SHA-256: 66aea62630ae9735aa08b1be2dfd7164a9aae9121152b7a652ceba208c3ebd61
sudo-debuginfo-1.7.2p1-14.el5_8.2.ppc.rpm	SHA-256: 3ee1bd3f64f63c7242e5ccb245176df510e0cb4fb574bdd033ba8fa9fba751e5

Red Hat Enterprise Linux Server from RHUI 5

SRPM
sudo-1.7.2p1-14.el5_8.2.src.rpm	SHA-256: 067f25c4a99a5847ee82e21cf2c571648cbf0c2adc0df5ab15b0d71a1d238d28
x86_64
sudo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 02cc3e167cc3e0952095e26175967a9b2d1a0fc3ee9ee8a7eea097e82924204b
sudo-debuginfo-1.7.2p1-14.el5_8.2.x86_64.rpm	SHA-256: 9d0fd724a85d925569b10e3fa53a2052e482e5ee8096ba5e13fdf346f5f3f7c6
i386
sudo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: ba523f2732f67949e972516a9a67a81e3393187c246d0a83b2eb48a224cc76e5
sudo-debuginfo-1.7.2p1-14.el5_8.2.i386.rpm	SHA-256: 47e9c41e28fb5ba4d20b8b292ede3718f6aa56313e340c7c3a0ea2e6448d631b