Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2656-1

Опубликовано: 14 окт. 2019
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issue:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Список пакетов

Container ses/6/cephcsi/cephcsi:latest
sudo-1.8.22-4.6.1
Container ses/6/rook/ceph:latest
sudo-1.8.22-4.6.1
Container ses/7/ceph/ceph:latest
sudo-1.8.22-4.6.1
Container ses/7/cephcsi/cephcsi:latest
sudo-1.8.22-4.6.1
Container ses/7/rook/ceph:latest
sudo-1.8.22-4.6.1
Container suse/sle-micro/5.0/toolbox:latest
sudo-1.8.22-4.6.1
SUSE Linux Enterprise Module for Basesystem 15
sudo-1.8.22-4.6.1
sudo-devel-1.8.22-4.6.1
SUSE Linux Enterprise Module for Basesystem 15 SP1
sudo-1.8.22-4.6.1
sudo-devel-1.8.22-4.6.1

Ссылки

Описание

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Затронутые продукты
Container ses/6/cephcsi/cephcsi:latest:sudo-1.8.22-4.6.1
Container ses/6/rook/ceph:latest:sudo-1.8.22-4.6.1
Container ses/7/ceph/ceph:latest:sudo-1.8.22-4.6.1
Container ses/7/cephcsi/cephcsi:latest:sudo-1.8.22-4.6.1
Ссылки