Security flaw in sudo versions 1.8.0 through 1.8.3p1

Summary:

A flaw exists in the debugging code in sudo versions 1.8.0 through
1.8.3p1 that can be used to crash sudo or potentially allow an
unauthorized user to elevate privileges.

Sudo versions affected:

1.8.0 through 1.8.3p1 inclusive.  Older versions of sudo are not
affected.

CVE ID:

This vulnerability has been assigned CVE 2012-0809 in the Common
Vulnerabilities and Exposures database.

Details:

Sudo 1.8.0 introduced simple debugging support that was primarily
intended for use when developing policy or I/O logging plugins.
The sudo_debug() function contains a flaw where the program name
is used as part of the format string passed to the fprintf() function.
The program name can be controlled by the caller, either via a
symbolic link or, on some systems, by setting argv[0] when executing
sudo.  For example:

    $ ln -s /usr/bin/sudo ./%s
    $ ./%s -D9
    Segmentation fault