未評価
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfe...
CVE-2019-18634
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2019-18634 sudo 修正版: 1.8.31-1
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
参照URL
- advisory packetstormsecurity.com
- advisory packetstormsecurity.com
- advisory seclists.org
- advisory openwall.com
- advisory openwall.com
- advisory openwall.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory lists.debian.org
- advisory seclists.org
- advisory seclists.org
- advisory seclists.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory support.apple.com
- advisory debian.org
- advisory sudo.ws
- report openwall.com
- report sudo.ws
- web lists.opensuse.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web usn.ubuntu.com
- web usn.ubuntu.com