openSUSE alert openSUSE-SU-2011:0050-1 (sudo) [LWN.net]


From:
    	       opensuse-security@opensuse.org 
To:
    	       opensuse-updates@opensuse.org 
Subject:
    	       openSUSE-SU-2011:0050-1 (moderate): sudo: security udpate 
Date:
    	       Wed, 19 Jan 2011 01:08:52 +0100 (CET)
Message-ID:
    	       <20110119000853.046AABE67@oldboy.suse.de>
Archive-link:
    	       Article, Thread
              
   openSUSE Security Update: sudo: security udpate
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2011:0050-1
Rating:             moderate
References:         #594738 #663881 
Cross-References:   CVE-2010-1163 CVE-2010-1646 CVE-2011-0010
                   
Affected Products:
                    openSUSE 11.3
                    openSUSE 11.2
______________________________________________________________________________

   An update that fixes three vulnerabilities is now available.

Description:

   This update of sudo fixes:
   - CVE-2011-0010: Does ask for the user password for GID
   changes now.
   - CVE-2010-1646: CVSS v2 Base Score: 6.6 (CWE-264): The
   secure environment option can handle multiple occurrence
   of PATH now.
   - CVE-2010-1163: CVSS v2 Base Score: 6.9 (CWE-20): Improved
   command matching.


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 11.3:

      zypper in -t patch sudo-3811

   - openSUSE 11.2:

      zypper in -t patch sudo-3811

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 11.3 (i586 x86_64):

      sudo-1.7.2p7-2.3.1

   - openSUSE 11.2 (i586 x86_64):

      sudo-1.7.2-2.5.1


References:

   http://support.novell.com/security/cve/CVE-2010-1163.html
   http://support.novell.com/security/cve/CVE-2010-1646.html
   http://support.novell.com/security/cve/CVE-2011-0010.html
   https://bugzilla.novell.com/594738
   https://bugzilla.novell.com/663881
(Log in to post comments)