Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:1697-1

Опубликовано: 26 июн. 2017
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following security issue:

  • CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. (bsc#1042146)

Also the following non security bug was fixed:

  • Link the 'system_group' plugin with sudo_util library to resolve the missing sudo_dso_findsym symbol (bsc#1034560)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Список пакетов

openSUSE Leap 42.2
sudo-1.8.10p3-9.6.1
sudo-devel-1.8.10p3-9.6.1
sudo-test-1.8.10p3-9.6.1

Ссылки

Описание

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

Затронутые продукты
openSUSE Leap 42.2:sudo-1.8.10p3-9.6.1
openSUSE Leap 42.2:sudo-devel-1.8.10p3-9.6.1
openSUSE Leap 42.2:sudo-test-1.8.10p3-9.6.1
Ссылки
Уязвимость openSUSE-SU-2017:1697-1