Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2020:0244-1

Опубликовано: 25 фев. 2020
Источник: suse-cvrf

Описание

Security update for sudo

This update for sudo fixes the following issues:

Security issue fixed:

  • CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers (bsc#1162202).

Non-security issue fixed:

  • Fixed an issue where sudo -l would ask for a password even though listpw was set to never (bsc#1162675).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.1
sudo-1.8.22-lp151.5.6.1
sudo-devel-1.8.22-lp151.5.6.1
sudo-test-1.8.22-lp151.5.6.1

Ссылки

Описание

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

Затронутые продукты
openSUSE Leap 15.1:sudo-1.8.22-lp151.5.6.1
openSUSE Leap 15.1:sudo-devel-1.8.22-lp151.5.6.1
openSUSE Leap 15.1:sudo-test-1.8.22-lp151.5.6.1
Ссылки