Описание
Security update for sudo
This update for sudo fixes the following issues:
- CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).
Список пакетов
SUSE Linux Enterprise Point of Sale 11 SP3
sudo-1.7.6p2-0.30.5.1
SUSE Linux Enterprise Server 11 SP4-LTSS
sudo-1.7.6p2-0.30.5.1
Ссылки
- Link for SUSE-SU-2019:14193-1
- E-Mail link for SUSE-SU-2019:14193-1
- SUSE Security Ratings
- SUSE Bug 1153674
- SUSE CVE CVE-2019-14287 page
Описание
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:sudo-1.7.6p2-0.30.5.1
SUSE Linux Enterprise Server 11 SP4-LTSS:sudo-1.7.6p2-0.30.5.1
Ссылки
- CVE-2019-14287
- SUSE Bug 1153674
- SUSE Bug 1156093