Home / mailings

PDF

[USN-2533-1] Sudo vulnerability

Posted on 16 March 2015
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-2533-1
March 16, 2015

sudo vulnerability
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Sudo would allow unintended access to files.

Software Description:
- sudo: Provide limited super user privileges to specific users

Details:

Jakub Wilk and Stephane Chazelas discovered that Sudo incorrectly handled=

the TZ environment variable. An attacker with Sudo access could possibly
use this issue to open arbitrary files, bypassing intended permissions.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
sudo 1.8.9p5-1ubuntu2.1
sudo-ldap 1.8.9p5-1ubuntu2.1

Ubuntu 14.04 LTS:
sudo 1.8.9p5-1ubuntu1.1
sudo-ldap 1.8.9p5-1ubuntu1.1

Ubuntu 12.04 LTS:
sudo 1.8.3p1-1ubuntu3.7
sudo-ldap 1.8.3p1-1ubuntu3.7

Ubuntu 10.04 LTS:
sudo 1.7.2p1-1ubuntu5.8
sudo-ldap 1.7.2p1-1ubuntu5.8

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-2533-1
CVE-2014-9680

Package Information:
https://launchpad.net/ubuntu/+source/sudo/1.8.9p5-1ubuntu2.1
https://launchpad.net/ubuntu/+source/sudo/1.8.9p5-1ubuntu1.1
https://launchpad.net/ubuntu/+source/sudo/1.8.3p1-1ubuntu3.7
https://launchpad.net/ubuntu/+source/sudo/1.7.2p1-1ubuntu5.8

 

TOP