Potential sudo security hole

Summary:
    A heap corruption bug exists in sudo versions 1.5.7 to 1.6.5p2
    (inclusive).  The problem affects expansion of the "%h" and
    "%u" escape sequences in the prompt.  Due to a bug it is possible
    to craft a prompt such that more bytes are written than have
    been allocated.

    Exploiting heap corruption bugs like this requires fairly
    in-depth knowledge of a system's malloc internals.  This class
    of bug has been exploited with the glibc malloc but not, to my
    knowledge, with the malloc shipped with OpenBSD.  It would be
    foolish, however, to simply assume that it is not exploitable
    on OpenBSD.

Details:
    Sudo expands "%h" and "%u" to the hostname and username
    respectively.  This is done in two steps.  In the first step
    sudo calculates the amount of memory required to hold the
    expanded string.  In the second step it does the actual string
    copying and escape sequence expansion.  The bug occurs because
    a variable used to store the last character seen was not
    re-initialized before the second loop.  Consequently, if the
    last character in the prompt is a '%' and the first character
    is a 'h' or 'u', sudo will mistakenly expand the 'h' or 'u',
    thinking the last character processed was a '%'.  This causes
    the computed length to be too small and the malloced buffer
    will overflow.

Credit:
    This problem was brought to my attention by Global InterSec LLC.
    For more information, see their advisory:
	http://www.globalintersec.com/adv/sudo-2002041701.txt

Patches:
    ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/025_sudo.patch
    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/020_sudo.patch
    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch

    The patches are already in the 2.9, 3.0 and 3.1 patch branches
    (aka the -stable branches).