Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:0407-1

Опубликовано: 19 фев. 2020
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issue:

Security issue fixed:

  • CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers (bsc#1162202).

Список пакетов

SUSE Linux Enterprise Server 12 SP2-BCL
sudo-1.8.10p3-10.26.1
SUSE Linux Enterprise Server 12 SP2-LTSS
sudo-1.8.10p3-10.26.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
sudo-1.8.10p3-10.26.1
SUSE OpenStack Cloud 7
sudo-1.8.10p3-10.26.1

Ссылки

Описание

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP2-BCL:sudo-1.8.10p3-10.26.1
SUSE Linux Enterprise Server 12 SP2-LTSS:sudo-1.8.10p3-10.26.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2:sudo-1.8.10p3-10.26.1
SUSE OpenStack Cloud 7:sudo-1.8.10p3-10.26.1
Ссылки