Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2667-1

Опубликовано: 15 окт. 2019
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issues:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Список пакетов

SUSE Enterprise Storage 4
sudo-1.8.10p3-10.23.1
SUSE Linux Enterprise Server 12 SP2-BCL
sudo-1.8.10p3-10.23.1
SUSE Linux Enterprise Server 12 SP2-LTSS
sudo-1.8.10p3-10.23.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
sudo-1.8.10p3-10.23.1
SUSE OpenStack Cloud 7
sudo-1.8.10p3-10.23.1

Ссылки

Описание

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Затронутые продукты
SUSE Enterprise Storage 4:sudo-1.8.10p3-10.23.1
SUSE Linux Enterprise Server 12 SP2-BCL:sudo-1.8.10p3-10.23.1
SUSE Linux Enterprise Server 12 SP2-LTSS:sudo-1.8.10p3-10.23.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.23.1
Ссылки