| Summary: | sudo new security issue CVE-2015-8239 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | davidwhodgins, makowski.mageia, marja11, sysadmin-bugs |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/694789/ | ||
| Whiteboard: | MGA5-32-OK MGA5-64-OK advisory | ||
| Source RPM: | sudo-1.8.15-3.mga6.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2016-07-19 16:43:01 CEST
David Walser
2016-07-19 16:43:08 CEST
Whiteboard:
(none) =>
MGA5TOO Assigning to all packagers collectively, since there is no maintainer for this package. CC:
(none) =>
makowski.mageia, marja11 Freeze push requested for Cauldron for 1.8.17p1. Also checked into Mageia 5 SVN. https://www.sudo.ws/stable.html Updated packages uploaded for Mageia 5 and Cauldron. Advisory: ======================== Updated sudo packages fix security vulnerability: A vulnerability in functionality for adding support of SHA-2 digests along with the command was found. The sudoers plugin performs this digest verification while matching rules, and later independently calls execve() to execute the binary. This results in a race condition if the digest functionality is used as suggested (in fact, the rules are matched before the user is prompted for a password, so there is not negligible time frame to replace the binary from underneath sudo) (CVE-2015-8239). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8239 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BLFXPDF67QZECU6EMPWYU4FGK6PNZ3M4/ ======================== Updated packages in core/updates_testing: ======================== sudo-1.8.17p1-1.mga5 sudo-devel-1.8.17p1-1.mga5 from sudo-1.8.17p1-1.mga5.src.rpm Version:
Cauldron =>
5 Tested it on two servers at work, one Mageia 5 i586 and the other Mageia 5 x86_64. It still works fine. Whiteboard:
(none) =>
MGA5-32-OK MGA5-64-OK
Dave Hodgins
2016-07-26 22:52:21 CEST
Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0261.html Status:
NEW =>
RESOLVED Another commit in this update: r1020459 | luigiwalser | 2016-06-06 12:41:06 -0400 (Mon, 06 Jun 2016) | 1 line remove INPUTRC from env_keep due to possible info leak (rhbz#1339935) fixed an issue that has just received a CVE request: http://www.openwall.com/lists/oss-security/2016/08/24/1 (In reply to David Walser from comment #6) > Another commit in this update: > r1020459 | luigiwalser | 2016-06-06 12:41:06 -0400 (Mon, 06 Jun 2016) | 1 > line > > remove INPUTRC from env_keep due to possible info leak (rhbz#1339935) > > fixed an issue that has just received a CVE request: > http://www.openwall.com/lists/oss-security/2016/08/24/1 This received CVE-2016-7091: http://openwall.com/lists/oss-security/2016/08/25/2 LWN reference for CVE-2016-7091: http://lwn.net/Vulnerabilities/705575/ |