Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:0409-1

Опубликовано: 19 фев. 2020
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issues:

Security issue fixed:

  • CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers (bsc#1162202).

Non-security issue fixed:

  • Fixed an issue where sudo -l would ask for a password even though listpw was set to never (bsc#1162675).

Список пакетов

Image SLES12-SP5-Azure-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-Basic-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-HPC-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-HPC-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-SAP-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-SAP-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-Standard-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-EC2-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-EC2-ECS-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-EC2-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-EC2-SAP-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-EC2-SAP-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-GCE-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-GCE-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-GCE-SAP-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-GCE-SAP-On-Demand
sudo-1.8.27-4.3.1
Image SLES12-SP5-OCI-BYOS-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-OCI-BYOS-SAP-BYOS
sudo-1.8.27-4.3.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
sudo-1.8.27-4.3.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
sudo-1.8.27-4.3.1
SUSE Linux Enterprise Server 12 SP5
sudo-1.8.27-4.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
sudo-1.8.27-4.3.1
SUSE Linux Enterprise Software Development Kit 12 SP5
sudo-devel-1.8.27-4.3.1

Ссылки

Описание

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-Basic-On-Demand:sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-HPC-BYOS:sudo-1.8.27-4.3.1
Image SLES12-SP5-Azure-HPC-On-Demand:sudo-1.8.27-4.3.1
Ссылки