A security issue has been reported in sudo, which can be exploited by malicious, local users to gain escalated privileges.

The security issue is caused due to an error within the command matching functionality, which can be exploited to run a "sudoedit" executable within the current working directory.

Successful exploitation may allow the execution of arbitrary code with escalated privileges, but requires that the attacker is allowed to use sudo's "sudoedit" pseudo-command, that the PATH environment variable contains "." while the directories do not contain any other "sudoedit" executable, and that the "ignore_dot" or "secure_path" options are disabled.

This is related to security issue #1 in:
SA38659

Solution
Update to version 1.6.9p22 and 1.7.2p6.

Provided and/or discovered by
Valerio Costamagna and Maurizio Agazzini, Mediaservice.net Srl

Changelog
Further details available to Secunia VIM customers

Original Advisory
sudo:
http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html

Mediaservice.net Srl:
http://lab.mediaservice.net/advisory/2010-02-sudo.txt

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers