Upstream has issued an advisory on October 26: https://www.sudo.ws/alerts/noexec_wordexp.html The issue is fixed in 1.8.18p1: https://www.sudo.ws/stable.html#1.8.18p1 Freeze push requested for Cauldron. We could probably just update it for Mageia 5.
Fedora has issued an advisory for this today (November 11): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DBELDP5KT7URCP7P3RQFYBBKPBNLAJY6/
Assigning to all packagers collectively, since there is no registered maintainer for this package.
CC: (none) => marja11Assignee: bugsquad => pkg-bugs
URL: (none) => http://lwn.net/Vulnerabilities/706398/
available in updates_testing SRPMS: sudo-1.8.18p1-1.mga5
CC: (none) => mageiaAssignee: pkg-bugs => qa-bugs
Advisory: ======================== Updated sudo packages fix security vulnerability: It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges (CVE-2016-7076). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7076 https://www.sudo.ws/alerts/noexec_wordexp.html https://www.sudo.ws/stable.html#1.8.18p1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DBELDP5KT7URCP7P3RQFYBBKPBNLAJY6/ ======================== Updated packages in core/updates_testing: ======================== sudo-1.8.18p1-1.mga5 sudo-devel-1.8.18p1-1.mga5 from sudo-1.8.18p1-1.mga5.src.rpm
Tested the main sudo package on mga5 32 bit VM. [mrambo@mga5test ~]$ rpm -qa | grep sudo sudo-1.8.17p1-1.mga5 [mrambo@mga5test ~]$ sudo vi /etc/group [sudo] password for mrambo: [mrambo@mga5test ~]$ sudo vi /etc/urpmi/urpmi.cfg - no request for pw as it was still cached. (enabled Updates Testing) [mrambo@mga5test ~]$ sudo urpmi sudo [mrambo@mga5test ~]$ rpm -qa | grep sudo sudo-1.8.18p1-1.mga5 (rebooted) [mrambo@mga5test ~]$ rpm -qa | grep sudo sudo-1.8.18p1-1.mga5 [mrambo@mga5test ~]$ sudo urpmi --auto-update [sudo] password for mrambo: [mrambo@mga5test ~]$ sudo urpmi --auto-update - no pw request - still cached. The updated package looks good to me on 32 bit mga5.
CC: (none) => mramboWhiteboard: (none) => MGA5-32-OK
Keywords: (none) => validated_updateWhiteboard: MGA5-32-OK => MGA5-32-OK advisoryCC: (none) => davidwhodgins, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0389.html
Status: NEW => RESOLVEDResolution: (none) => FIXED