Stay Secure with the Latest Linux Advisories

security advisorysecurity issuecritical

Mageia 7: 2020-0246 Critical: Sudo Security Issue - Restriction Bypass

Updated sudo packages fix security vulnerabilities: It was found that sudo always allowed commands to be run with unknown user or group ids if the sudo configuration allowed it for example via the "ALL" alias. This could allow sudo to impersonate non-existent . MGASA-2020-0246 - Updated sudo packages fix security vulnerability Publication date: 10 Jun 2020 URL: https://advisories.mageia.org/MGASA-2020-0246.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-19232, CVE-2019-19233, CVE-2019-19234 Updated sudo packages fix security vulnerabilities: It was found that sudo always allowed commands to be run with unknown user or group ids if the sudo configuration allowed it for example via the "ALL" alias. This could allow sudo to impersonate non-existent account and depending on how applications are configured, could lead to certain restriction bypass. This is now explicitly disabled. A new setting called "allow_unknown_runas_id" was introduced in order to enable this (CVE-2019-19232). When an account is disabled via the shadow file, by replacing the password hash with "!", it is not considered disabled by sudo. And depending on the configuration, sudo can be run by using such disabled account (CVE-2019-19234). The sudo package has been updated to version 1.8.31p1, fixing these issues and other bugs. References: - https://bugs.mageia.org/show_bug.cgi?id=26314 - https://www.cve.org/CVERecord?id=CVE-2019-19232 - https://www.cve.org/CVERecord?id=CVE-2019-19234 - - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/ - https://www.cve.org/CVERecord?id=CVE-2019-19232 - https://www.cve.org/CVERecord?id=CVE-2019-19233 - https://www.cve.org/CVERecord?id=CVE-2019-19234 SRPMS: - 7/core/sudo-1.8.31p1-1.1.mga7 . Recent updates to sudo packages in Mageia tackle critical security vulnerabilities associated with user impersonation. Find out more!. Mageia Sudo Update, Security Fix, Runas ID Issue. . Severity: Critical.LinuxSecurity.com Team

Jun 10, 2020 •Critical Mageia