Test ID:	1.3.6.1.4.1.25623.1.0.53982
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-735-2)
Summary:	The remote host is missing an update for the Debian 'sudo' package(s) announced via the DSA-735-2 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'sudo' package(s) announced via the DSA-735-2 advisory. Vulnerability Insight: A local user who has been granted permission to run commands via sudo could run arbitrary commands as a privileged user due to a flaw in sudo's pathname validation. This bug only affects configurations which have restricted user configurations prior to an ALL directive in the configuration file. A workaround is to move any ALL directives to the beginning of the sudoers file, see the advisory at for more information. For the old stable Debian distribution (woody), this problem has been fixed in version 1.6.6-1.3woody1. For the current stable distribution (sarge), this problem has been fixed in version 1.6.8p7-1.1sarge1. Note that packages are not yet ready for certain architectures, these will be released as they become available. We recommend that you upgrade your sudo package. Affected Software/OS: 'sudo' package(s) on Debian 3.0, Debian 3.1. Solution: Please install the updated package(s). CVSS Score: 3.7 CVSS Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2005-1993 13993 http://www.securityfocus.com/bid/13993 15647 http://www.securityfocus.com/bid/15647 15744 http://secunia.com/advisories/15744 17396 http://www.osvdb.org/17396 17813 http://secunia.com/advisories/17813 20050620 Sudo version 1.6.8p9 now available, fixes security issue. http://www.securityfocus.com/archive/1/402741 ADV-2005-0821 http://www.vupen.com/english/advisories/2005/0821 ADV-2005-2659 http://www.vupen.com/english/advisories/2005/2659 APPLE-SA-2005-11-29 http://docs.info.apple.com/article.html?artnum=302847 DSA-735 http://www.debian.org/security/2005/dsa-735 FLSA:162750 http://www.securityfocus.com/archive/1/425974/100/0/threaded RHSA-2005:535 http://www.redhat.com/support/errata/RHSA-2005-535.html SUSE-SA:2005:036 http://www.novell.com/linux/security/advisories/2005_36_sudo.html http://www.sudo.ws/sudo/alerts/path_race.html https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161116 oval:org.mitre.oval:def:11341 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11341 oval:org.mitre.oval:def:1242 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1242 sudo-pathname-race-condition(21080) https://exchange.xforce.ibmcloud.com/vulnerabilities/21080
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.