------------------------------------------------------------------------
Pardus Linux Security Advisory 2009-17            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2009-01-31
  Severity: 3
      Type: Local
------------------------------------------------------------------------

Summary
=======

There is a vulnerability in sudo: valid sudoers rules might give  users 
root access without password authentication. 


Description
===========

The parse.c file in sudo 1.6.9p17 through 1.6.9p19  does  not  properly 
interpret a system group  (aka  %group)  in  the  sudoers  file  during 
authorization decisions for a user who belongs  to  that  group,  which 
allows local users to leverage an applicable sudoers file and gain root 
privileges via a sudo command. 


Affected packages:

  Pardus 2008:
    sudo, all before 1.6.9_p17-22-4


Resolution
==========

There are update(s) for sudo. You can update them via Package Manager or
with a single command from console: 

    pisi up sudo

References
==========

  * http://bugs.pardus.org.tr/show_bug.cgi?id=9117
  * https://bugzilla.novell.com/show_bug.cgi?id=468923
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0034