Stay Secure with the Latest Linux Advisories

security advisorysecurity issuebuffer overflow

Mageia Advisory: 2020-0081 Moderate Sudo Buffer Overflow Vulnerability

The updated packages fix a security vulnerability: In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, . MGASA-2020-0081 - Updated sudo packages fix security vulnerability Publication date: 09 Feb 2020 URL: https://advisories.mageia.org/MGASA-2020-0081.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-18634 The updated packages fix a security vulnerability: In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. (CVE-2019-18634) References: - https://bugs.mageia.org/show_bug.cgi?id=26155 - - https://www.openwall.com/lists/oss-security/2020/01/30/6 - - https://www.cve.org/CVERecord?id=CVE-2019-18634 SRPMS: - 7/core/sudo-1.8.28-1.1.mga7 . Recent updates for sudo packages fix a critical buffer overflow vulnerability impacting Mageia systems. Administrators must act swiftly to protect their environments. Sudo Update, Mageia Security, Buffer Overflow, Privileged Access. . LinuxSecurity.com Team

Feb 09, 2020 Mageia