Chronophage.net Blog

Three Lunches for the executive offices in the sky
Seven for middle management stuck on the phone
Nine for salesmen, doomed to lie
One for the CEO who eats alone
In the land of Mordor where the Gyros lie
One lunch to feed them all, One to then unwind them
One lunch to make their bowels crawl, and on the toilet bind them
In the land of Mordor where the Gyros lie.

“Sudo’s command matching routine expects actual commands to include one or more slash (‘/’) characters. The flaw is that sudo’s path resolution code did not add a “./” prefix to commands found in the current working directory. This creates an ambiguity between a “sudoedit” command found in the cwd and the “sudoedit” pseudo-command in the sudoers file. As a result, a user may be able to run an arbitrary command named “sudoedit” in the current working directory. For the attack to be successful, the PATH environment variable must include “.” and may not include any other directory that contains a “sudoedit” command.”
(From http://portaudit.FreeBSD.org/1a9f678d-48ca-11df-85f8-000c29a67389.html)

I actually read about this on Full Disclosure. This is very similar to an earlier exploit. Sudo is a great tool, but you always have to be *very* careful who you give sudo access to.