Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

SUSE: 2014:0475-1 Important: Sudo Policy Bypass and Fixes

suse
Calendar Grey April 3, 2014
Scroller Suse
SUSE Security Notification: Major update for sudo, resolves critical security flaw and improves overall system stability.
An update that solves one vulnerability and has two fixes An update that solves one vulnerability and has two fixes An update that solves one vulnerability and has two fixes is now...

Summary

This collective update for sudo provides fixes for the following issues: * Security policy bypass when env_reset is disabled. (CVE-2014-0106, bnc#866503) * Regression in the previous update that causes a segmentation fault when running "sudo -s". (bnc#868444) * Command "who -m" prints no output when using log_input/log_output sudo options. (bnc#863025) Security Issues references: * CVE-2014-0106 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-sudo-9044 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-sudo-9044

Topics%20covered

Topics Covered

security advisory sudo system update SUSE important fix segmentation fault policy bypass

References

#863025 #866503 #868444

Cross- CVE-2014-0106

Affected Products:

SUSE Linux Enterprise Server 11 SP3 for VMware

SUSE Linux Enterprise Server 11 SP3

SUSE Linux Enterprise Desktop 11 SP3

https://www.suse.com/security/cve/CVE-2014-0106.html

https://scc.suse.com:443/patches/

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2014:0475-1
Rating: important

Topics%20covered

Topics Covered

security advisory sudo system update SUSE important fix segmentation fault policy bypass

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.