sudo -- Privilege escalation with sudoedit

Todd Miller reports:

Sudo’s command matching routine expects actual commands to include
one or more slash (‘/’) characters. The flaw is that sudo’s path
resolution code did not add a “./” prefix to commands found in the
current working directory. This creates an ambiguity between a
“sudoedit” command found in the cwd and the “sudoedit”
pseudo-command in the sudoers file. As a result, a user may be
able to run an arbitrary command named “sudoedit” in the current
working directory. For the attack to be successful, the PATH
environment variable must include “.” and may not include any other
directory that contains a “sudoedit” command.