Title: EGI SVG Advisory [TLP:WHITE] 'Moderate' risk - sudo local root
vulnerability CVE-2017-1000367 [EGI-SVG-CVE-2017-1000367]
Date: 2017-06-06
Updated:
Affected software and risk
==========================
Vulnerability concerning sudo.
Package : sudo
CVE ID : CVE-2017-1000367
Privilege escalation vulnerability in sudo via improper get_process_ttyname()
parsing.
Although sudo is used in the CREAM-CE, it is under normal circumstances not
exploitable by itself in a properly configured site.
We are not aware of any other Grid-related uses of sudo that would be exploitable.
See [R 1]
Actions required/recommended
============================
Sites are recommended to update relevant components as soon as it is
convenient.
Sites should verify that they don't run an exploitable configuration of sudo
(i.e. run sudo with a sudoers file that limits for example the list of allowed
commands or only allows running as non-root users).
Affected software details
=========================
See [R 2], [R 3], [R 4], [R 5]
More information
================
See [R 1], [R 2], [R 3], [R 4], [R 5]
Component installation information
==================================
Sites should see appropriate vendor sites.
For Scientific Linux see [R 2]
For RedHat see [R 3]
For Ubuntu see [R 4]
For Debian see [R 5]
TLP and URL
===========
** WHITE information - Unlimited distribution -
see https://go.egi.eu/tlp for distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2017-1000367
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 6]
References
==========
[R 1] http://www.openwall.com/lists/oss-security/2017/05/30/16
[R 2] https://www.scientificlinux.org/?s=cve-2017-1000367
[R 3] https://access.redhat.com/security/cve/CVE-2017-1000367
[R 4] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000367.html
[R 5] https://security-tracker.debian.org/tracker/CVE-2017-1000367
[R 6] https://documents.egi.eu/public/ShowDocument?docid=2538
Credit
======
SVG was alerted to this vulnerability by Sven Gabriel
Timeline
========
Yyyy-mm-dd [EGI-SVG-2017-CVE-2017-1000367]
2017-06-01 SVG alerted to this issue by Sven Gabriel
2017-06-01 Investigation of vulnerability and relevance to EGI carried out
2017-06-02 Unclear whether exploitable in EGI, but decided to send an alert ot
sites
2017-06-06 Advisory/Alert sent to sites
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 6] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct.
The risk may also be higher or lower in other deployments depending on how the
software is used.
Others may re-use this information provided they:-
1) Respect the provided TLP classification
2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group
On behalf of the EGI SVG,