drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in sudo
Name: |
Ausführen beliebiger Kommandos in sudo |
|
ID: |
USN-1442-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 11.04, Ubuntu 11.10, Ubuntu 12.04 LTS |
|
Datum: |
Do, 17. Mai 2012, 08:30 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2337 |
|
Applikationen: |
sudo |
|
Originalnachricht |
--===============1309211592551076694== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Dxnq1zWXvFF0Q93v" Content-Disposition: inline
--Dxnq1zWXvFF0Q93v Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-1442-1 May 16, 2012
sudo vulnerability ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS
Summary:
Sudo could allow users to run arbitrary programs as the administrator.
Software Description: - sudo: Provide limited super user privileges to specific users
Details:
It was discovered that sudo incorrectly handled network masks when using Host and Host_List. A local user who is listed in sudoers may be allowed to run commands on unintended hosts when IPv4 network masks are used to grant access. A local attacker could exploit this to bypass intended access restrictions. Host and Host_List are not used in the default installation of Ubuntu.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: sudo 1.8.3p1-1ubuntu3.2 sudo-ldap 1.8.3p1-1ubuntu3.2
Ubuntu 11.10: sudo 1.7.4p6-1ubuntu2.1 sudo-ldap 1.7.4p6-1ubuntu2.1
Ubuntu 11.04: sudo 1.7.4p4-5ubuntu7.2 sudo-ldap 1.7.4p4-5ubuntu7.2
Ubuntu 10.04 LTS: sudo 1.7.2p1-1ubuntu5.4 sudo-ldap 1.7.2p1-1ubuntu5.4
Ubuntu 8.04 LTS: sudo 1.6.9p10-1ubuntu3.9 sudo-ldap 1.6.9p10-1ubuntu3.9
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-1442-1 CVE-2012-2337
Package Information: https://launchpad.net/ubuntu/+source/sudo/1.8.3p1-1ubuntu3.2 https://launchpad.net/ubuntu/+source/sudo/1.7.4p6-1ubuntu2.1 https://launchpad.net/ubuntu/+source/sudo/1.7.4p4-5ubuntu7.2 https://launchpad.net/ubuntu/+source/sudo/1.7.2p1-1ubuntu5.4 https://launchpad.net/ubuntu/+source/sudo/1.6.9p10-1ubuntu3.9
--Dxnq1zWXvFF0Q93v Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBCgAGBQJPtAADAAoJENaSAD2qAscKLeEQAIpcn9ojve9aTqx8UCh+pAk8 iJ60OTlK3/RkGJh70olIbISdQMm/3t3WfehHYd+8RZAzrRaSzUOm0zr08azgDBVV lIeTw9R5dkS2+0Gg23YJRAOnxU3+LoU/p87Q3rx/aVIM/hsmaE2IakWBmF1b5iQL C0aWAmrxIKDe5rw/5kzFrD5DM2aHLjE31WS8rmucHnkVqqS1PfS0Twa0PbX2k8B2 c/qWhTWdYzIwQyRweVj3LZWhqge+7kt5QXz8XWBwK4n4WLqnJO4UQQu3PkXNhZ42 nUBfIj80v2+QFseCCk/jjk9OfVobeixKZHlPNO/N347Za5cftnDPnWpjJeNB7hwU PUTiyUZctVP+CtcS6MplNjsnaaUMWu0DPJv/LDb55E+h8hwBF6n67eRe6AYP8ocR b6h5gZDbL4MCzk+MAYaI4uq7m4D6tkTy1dScKeMYA1n/O/DLkX6HAQwA27mWtsqo AoNaU5wQ0l66e/HYjbNRfHaKgI439C6r5Vg0j8WK5kVALreNwUIbYFxSVYJcfwgp /sd1oLBAeABM+tVafeEXqSGi+p4/q860NO/Ir2TWs30RrdgdRRopnNr2iXSEvRO9 KXMC/gIpgbK7firmR7P/f+RatB9pOYrWpvbq+5edMZyeHVsS3vSERO4TrNPIrUGu R3wtF1XbVTTS1jW5Acj2 =cqSz -----END PGP SIGNATURE-----
--Dxnq1zWXvFF0Q93v--
--===============1309211592551076694== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============1309211592551076694==--
|
|
|
|