Описание
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| sudo | fixed | 1.8.12-1 | package | |
| sudo | fixed | 1.8.10p3-1+deb8u2 | jessie | package |
Примечания
https://www.openwall.com/lists/oss-security/2014/10/15/24
http://www.sudo.ws/repos/sudo/rev/650ac6938b59 (1.8.x)
http://www.sudo.ws/repos/sudo/rev/ac1467f71ac0 (typos)
http://www.sudo.ws/repos/sudo/rev/91859f613b88 (description)
http://www.sudo.ws/repos/sudo/rev/579b02f0dbe0 (improved description)
https://www.openwall.com/lists/oss-security/2015/02/09/12
EPSS
Связанные уязвимости
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
EPSS