USN-142-1: sudo vulnerability

Releases

• Ubuntu 5.04
• Ubuntu 4.10

Details

Charles Morris discovered a race condition in sudo which could lead to
privilege escalation. If /etc/sudoers allowed a user the execution of
selected programs, and this was followed by another line containing
the pseudo-command "ALL", that user could execute arbitrary commands
with sudo by creating symbolic links at a certain time.

Please note that this does not affect a standard Ubuntu installation.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 5.04

• sudo -

Ubuntu 4.10

• sudo -

In general, a standard system update will make all the necessary changes.

References

• CVE-2005-1993