Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2668-1

Опубликовано: 15 окт. 2019
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo provides the following fix:

Security issue fixed:

  • CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers (bsc#1153674).

Other issues fixed:

  • Cache resolved group names as calling getgrgid() is expensive and on systems connected to AD with many users, groups or sudo rules it causes sudo to take a long time to run (bsc#1068003).
  • Disable insults by default at build time. For new installations this was done via sudoers file, but when upgrading from previous versions it would accidentally be enabled (bsc#1053911).
  • Enable support for zlib compressed I/O logs (bsc#1058297).

Список пакетов

SUSE Linux Enterprise Server 12 SP1-LTSS
sudo-1.8.10p3-2.28.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
sudo-1.8.10p3-2.28.1

Ссылки

Описание

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP1-LTSS:sudo-1.8.10p3-2.28.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1:sudo-1.8.10p3-2.28.1
Ссылки