<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Hi,</div><div><br></div><div><br></div><div>There's a format string vulnerability in sudo version 1.8.x.<br></div><div><br></div><div>In case you can't upgrade to the latest sudo which patches this</div><div>vulnerability among other things (1.8.3p2)</div><div><br></div><div>CVE is not posting details for the moment:<br></div><div>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-0809</div><div><br></div><div>It can work even without having the user added to the sudoers list. If</div><div>the user can execute sudo, that's enough to start playing around, and gain root.<br></div><div><br></div><div>I wrote a patch based on the fix provided by millert.<br></div><div>http://devio.us/~loganaden/sudo.c.patch. It works on older 1.8.x releases.</div><div><br></div><div>Instructions:<br></div><div>cp sudo.c
sudo.c.orig</div><div>patch < sudo.c.patch</div><div><br></div><div>I'd advise to update to the latest version which has other fixes as well.</div><div></div></div></body></html>