Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2666-1

Опубликовано: 15 окт. 2019
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issues:

Security issue fixed:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Список пакетов

HPE Helion OpenStack 8
sudo-1.8.20p2-3.14.1
SUSE Enterprise Storage 5
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Desktop 12 SP4
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Server 12 SP3-BCL
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Server 12 SP3-LTSS
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Server 12 SP4
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Software Development Kit 12 SP4
sudo-devel-1.8.20p2-3.14.1
SUSE OpenStack Cloud 8
sudo-1.8.20p2-3.14.1
SUSE OpenStack Cloud Crowbar 8
sudo-1.8.20p2-3.14.1

Ссылки

Описание

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Затронутые продукты
HPE Helion OpenStack 8:sudo-1.8.20p2-3.14.1
SUSE Enterprise Storage 5:sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Desktop 12 SP4:sudo-1.8.20p2-3.14.1
SUSE Linux Enterprise Server 12 SP3-BCL:sudo-1.8.20p2-3.14.1
Ссылки