-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0015
  A vulnerability exists which can lead to a crash or privilege elevation
                              1 February 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              sudo
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Root Compromise   -- Existing Account
                      Denial of Service -- Existing Account
Resolution:           Patch/Upgrade
CVE Names:            CVE 2012-0809  
Member content until: Friday, March  2 2012

OVERVIEW

        A standard format string vulnerability exists in sudo versions 1.8.0 
        through to 1.8.3p1, which can be used to crash sudo or allow privilege 
        elevation.


IMPACT

        Vulnerability description provided by the vendor:
        
        "Successful exploitation of the bug will allow a user to run arbitrary 
        commands as root.
        
        Exploitation of the bug does not require that the attacker be listed in 
        the sudoers file. As such, we strongly suggest that affected sites 
        upgrade from affected sudo versions as soon as possible."[1]


MITIGATION

        Upgrade sudo to version 1.8.3p2.


REFERENCES

        [1] Sudo format string vulnerability
            http://www.sudo.ws/sudo/alerts/sudo_debug.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTyjncu4yVqjM2NGpAQK+SA/+IihjP1VTPP4yh5+gxMSdgvPadfbQwJku
yHJAcjGipZcKQvKHFBQI0Q8R6wYSA32oG607HmufQPIzYjU2kOCaCN12sMtHuAnG
zAFdfIzQ5abF6sSQ8o9inNqjsLjxWMFDEMoSgg2wzLYWaDMCB594XhdtNOa+0x06
AgvfCglrrtKCz2RpIK7z1QevMIbyDUfxH5XRg9/5Hg4rHFelKN1mz9w5+JYG6R9U
n4Zua69EL6BW5FzYyQineftVHXEYTDcFd+tF7o+UZEvZW7gw8ZhUVGV6fwcV43SF
eiDAoO2QNSATdbSHNm7U+uA84vqWLw2MCdslwdOgvhwHL8UMCj6caQCRDMyEYccO
BYbI65Wf9qeUif/V1bFHEwMdHSk9+yOH2EQ7MO6WKltrRydFAW6gX3q0anttEN28
cZNqBt2+kgzV2VG4giCsWDTI7MqosEIaxNgaq8ub7sP1ijTrseLb6ptm/cZENa1F
LbZdTmFuwgqP3MfKU1SbWKnf1QmbxH1LaA7uaAjvtIdw3OglvOsYyAI6JZ2kYot9
CaI09IHiU7ifWtYDdya6iTCaE5bMlXEs3bR1MjGf9QKsdkPWdCxR9S+Y0juRm/ZA
kOnkj2MJWlJlHKIgbzbo0h+I5r0jxFeXR3xlfbv3OKbzV9dbB7ZA57VKOjM2xQ1H
V3BvNklDGe8=
=Blol
-----END PGP SIGNATURE-----