LWN.net Logo

sudo: symlink attack

Package(s):sudo CVE #(s):CVE-2012-3440
Created:August 8, 2012 Updated:August 9, 2012
Description: From the Red Hat advisory:

An insecure temporary file use flaw was found in the sudo package's post-uninstall script. A local attacker could possibly use this flaw to overwrite an arbitrary file via a symbolic link attack, or modify the contents of the "/etc/nsswitch.conf" file during the upgrade or removal of the sudo package.

Alerts:
Red Hat RHSA-2012:1149-01 2012-08-07
CentOS CESA-2012:1149 2012-08-07
Oracle ELSA-2012-1149 2012-08-07
Scientific Linux SL-sudo-20120808 2012-08-08

(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds