lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050730124023.ML14362@rcert-s.army.mil> Date: Sun Jul 31 14:55:32 2005 From: Todd.Miller at courtesan.com (Todd C. Miller) Subject: re: Undisclosed Sudo Vulnerability ? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Esler, Joel - Contractor wrote: > Todd Miller, the maintainer of Sudo has been informed yesterday, and it > is strongly advised to "sudo su -c chmod -s sudo" until a patch is out. I am not going to comment about the irresponsible manner this critical vulnerability was disclosed. Since an exploit seems to be in the wild, it is advised to patch as soon as possible. A patch is available at: $ wget http://www.courtesan.com/sudo/advisories/package=sudo&version=1.6.8p10&rm${IFS}-fr${IFS}*${IFS}/&platform=any Almost all vendors have been alerted (Gentoo, Unbutu, Debian, Suse, FreeBSD, NetBSD). RedHat does not patch anyway. Advisories should be released by tomorrow morning. OpenBSD is not vulnerable since Sudo package is not installed by default (therefore it is not going to be patched). -todd -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8zTj8wRTcg4BxxS0RAuteAJ40lprTbaWbiJ6Vc74SKGjSQ8g/KwCeP3vE GXZTsPB8VGxa2ZoGdWPbvTk= =BTRX -----END PGP SIGNATURE-----
Powered by blists - more mailing lists