Alerts This Week
Warning Icon 1 409
Alerts This Week
Warning Icon 1 409

Mageia Advisory: 2020-0081 Moderate Sudo Buffer Overflow Vulnerability

mageia
Calendar Grey February 9, 2020
Dist Mageia Esm H88
Recent updates for sudo packages fix a critical buffer overflow vulnerability impacting Mageia systems. Administrators must act swiftly to protect their environments
The updated packages fix a security vulnerability: In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileg...

Summary

The updated packages fix a security vulnerability:
In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. (CVE-2019-18634)

References

- https://bugs.mageia.org/show_bug.cgi?id=26155

- - https://www.openwall.com/lists/oss-security/2020/01/30/6

- - https://www.cve.org/CVERecord?id=CVE-2019-18634

Topics%20covered

Topics Covered

security advisory security issue buffer overflow sudo Mageia privileged process

Resolution

SRPMS

- 7/core/sudo-1.8.28-1.1.mga7

Publication date: 09 Feb 2020
URL: https://advisories.mageia.org/MGASA-2020-0081.html
Type: security
CVE: CVE-2019-18634

Topics%20covered

Topics Covered

security advisory security issue buffer overflow sudo Mageia privileged process

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here