Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2016:2893-1

Опубликовано: 23 нояб. 2016
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issues:

  • fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
    • noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
    • noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]

Список пакетов

SUSE Linux Enterprise Desktop 12 SP2
sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server 12 SP2
sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
sudo-1.8.10p3-8.1
SUSE Linux Enterprise Software Development Kit 12 SP2
sudo-devel-1.8.10p3-8.1

Ссылки

Описание

sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-8.1
Ссылки

Описание

sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server 12 SP2:sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:sudo-1.8.10p3-8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-8.1
Ссылки
Уязвимость SUSE-SU-2016:2893-1