sudo-1.8.23-4.el7.1
エラータID: AXSA:2019-4363:03
Release date:
Thursday, October 24, 2019 - 12:45
Subject:
sudo-1.8.23-4.el7.1
Affected Channels:
Asianux Server 7 for x86_64
Severity:
High
Description:
[Security Fix]
- sudoには、ALL に Runas できるアカウントを持つ攻撃者が
特別に細工されたユーザーID(例えば 0xffffffff) によって、ポリシー
ブラックリストとPAMモジュールをバイパスでき、さらに、正しくないログ
を残すことを許してしまう脆弱性があります。(CVE-2019-14287)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
Solution:
パッケージをアップデートしてください。
CVEs:
CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Additional Info:
N/A
Download:
SRPMS
- sudo-1.8.23-4.el7.1.src.rpm
MD5: 2fc7da20f4c1afee27df509bee349e5e
SHA-256: 983d6c6bfa3fc82c1c166f1585c80cabc16d0f6a85c73ba6cc28398fd416a509
Size: 3.06 MB
Asianux Server 7 for x86_64
- sudo-1.8.23-4.el7.1.x86_64.rpm
MD5: 32258227b6a37636d09fde3e24dd40d3
SHA-256: fa1f5794bcb8497915fe6489667ec51ab9b9f0f25f9a5bc0628f9f8a7a68d630
Size: 840.28 kB