~ubuntu-branches/ubuntu/hardy/sudo/hardy-updates : changes

~ubuntu-branches/ubuntu/hardy/sudo/hardy-updates » Changes from revision 28

From Revision 28 to 9

Rev	Summary	Authors	Tags	Date
28	* SECURITY UPDATE: authentication bypass via clock set to ep... * SECURITY UPDATE: authentication bypass via clock set to epoch - debian/patches/CVE-2013-1775.patch: ignore time stamp file if it is set to epoch in check.c. - backported from ddf399e3e306ca238f6f1cda8153889b15bba12e - CVE-2013-1775	Marc Deslauriers	1.6.9p10-1ubuntu3.10	11 years ago
27	* SECURITY UPDATE: Properly handle multiple netmasks in sudo... * SECURITY UPDATE: Properly handle multiple netmasks in sudoers Host and Host_List values - parse.c: Prevent IPv6 netmask-based address matching logic from incorrectly being applied to IPv4 addresses. Based on upstream patch written by Todd C. Miller. - CVE-2012-2337	Tyler Hicks	1.6.9p10-1ubuntu3.9	11 years ago
26	* SECURITY UPDATE: properly handle multiple PATH variables w... * SECURITY UPDATE: properly handle multiple PATH variables when using secure_path in env.c - http://www.sudo.ws/repos/sudo/raw-rev/3057fde43cf0 - CVE-2010-1646	Jamie Strandboge	1.6.9p10-1ubuntu3.8	13 years ago
25	* SECURITY UPDATE: properly verify path in find_path.c for t... * SECURITY UPDATE: properly verify path in find_path.c for the 'sudoedit' pseudo-command when running from the current working directory and secure_path is disabled - CVE-2010-XXXX	Jamie Strandboge	1.6.9p10-1ubuntu3.7	14 years ago
24	* SECURITY UPDATE: properly verify path for the 'sudoedit' p... * SECURITY UPDATE: properly verify path for the 'sudoedit' pseudo-command in parse.c - http://sudo.ws/repos/sudo/rev/f86e1b56d074 - CVE-2010-0426 * SECURITY UPDATE: reset cached supplementary runas groups when changing the runas user in set_perms.c and sudo.c - http://sudo.ws/repos/sudo/rev/aa0b6c01c462 - CVE-2010-0427	Jamie Strandboge	1.6.9p10-1ubuntu3.6	14 years ago
23	* SECURITY UPDATE: privilege escalation via non-default syst... * SECURITY UPDATE: privilege escalation via non-default system groups. - parse.c: upstream fix for CVE-2009-0034: http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c?r1=1.160.2.21&r2=1.160.2.22	Kees Cook	1.6.9p10-1ubuntu3.4	15 years ago
22	env.c: Add "http_proxy" to initial_keepenv_table, so that it... env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept for "sudo apt-get ...". This is an EBW workaround for a design problem of not having a system-wide proxy setting, but in order to not break existing practice for upgrades we have to live with it for Hardy.	Martin Pitt	1.6.9p10-1ubuntu3	16 years ago
21	No-change rebuild against libldap-2.4-2. No-change rebuild against libldap-2.4-2.	Steve Langasek	1.6.9p10-1ubuntu2	16 years ago
20	* Merge with Debian unstable. Remaining Ubuntu changes: * Merge with Debian unstable. Remaining Ubuntu changes: - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu specific) - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. (Ubuntu specific) - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. (Ubuntu specific) * The password prompt asks for the target user's password now, not the invoking one's. (LP: #148498)	Martin Pitt	1.6.9p10-1ubuntu1	16 years ago
19	* Merge with Debian unstable. Remaining Ubuntu changes: * Merge with Debian unstable. Remaining Ubuntu changes: - debian/prerm: Abort package removal if there is no root password. (Debian #451241). - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu specific) - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. (Ubuntu specific) - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. (Ubuntu specific) * sudo.c, parse.c: Apply a change that was missing from the older upstream tarball that fixes the upstream solution of "SETENV is implicit for ALL". We do not want to deviate our orig.tar.gz from Debian's, though.	Martin Pitt	1.6.9p9-1ubuntu1	16 years ago
18	* Merge with Debian unstable. Remaining Ubuntu changes: * Merge with Debian unstable. Remaining Ubuntu changes: - debian/prerm: Abort package removal if there is no root password. Forwarded to Debian #451241. - sudoers: Add some explanatory text why it is a REALLY good idea to use visudo. (LP #11620) Forwarded upstream: http://www.gratisoft.us/bugzilla/show_bug.cgi?id=269 - debian/rules: Disable lecture, enable tty_tickets by default. - debian/rules: Configure less confusing default password prompt to point out that it is sudo asking for the user's password, as opposed to another program like ssh, or asking for the root password. (LP #8556) Forwarded to Debian #343268. - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. * New upstream version 1.6.9 fixes the following bugs: - Does not ask for password any more if stdin is not a terminal. (LP: #130636) - sudo -k/-K does not fail any more if timestamp is in the future. (LP: #43233) * Drop our very intrusive patch for selectively cleaning the environment based on whether the user can execute all commands or only some. Debian and upstream now default to cleaning the environment unconditionally and provide option -E and the SETENV tag to override it. Instead, do a tinpy patch to parse.yacc which enables SETENV implicitly for 'ALL' commands. Forwarded upstream: http://www.gratisoft.us/bugzilla/show_bug.cgi?id=268 * sudo.c: Disable i18n for now (upstream enabled it in 1.6.9), since this causes PAM to output localized password prompts, which in turn breaks -p and --with-passprompt, which finally breaks gksu. See http://www.gratisoft.us/bugzilla/show_bug.cgi?id=270 for details.	Martin Pitt	1.6.9p6-1ubuntu1	16 years ago
17	debian/rules: Configure less confusing default password prom... debian/rules: Configure less confusing default password prompt to (a) point out that it wants to know the user's password (instead of root's or whichever) and (b) that it is sudo which asks the question (since those prompts become really unintelligible if the command asks its own password, such as 'ssh', 'passwd', or 'mount -t cifs'). Do not modify --with-badpass-message though, since that breaks gksu. Thanks to Marco Rodrigues, leoquant, and nxvl for the discussion and proposals. (LP: #8556)	Martin Pitt	1.6.8p12-5ubuntu2	16 years ago
16	* Merge to Debian unstable. Remaining Ubuntu changes: * Merge to Debian unstable. Remaining Ubuntu changes: - parse.{h,c,yacc}, sudo.tab.cc, sudo.h, ldap.c, env.c, sudo.c: Clean up environment variable handling to fix vulns like CVE-2005-4158 and CVE-2006-0151 once and for all: Only keep known-good variables if user has limited sudo privileges (blacklist -> whitelist) and keep them all for users with unlimited command privileges (to not drive admins and developers up the wall which actually need to pass env variables from time to time). See 1.6.8p12-1ubuntu1 changelog for details. - sudoers: Add some explanatory text why it is a REALLY good idea to use visudo. (LP #11620) - debian/control, debian/rules: Enable krb5 support, add libkrb5-dev build dependency. (LP #35001) - debian/postinst: Disable lecture, enable tty_tickets in default sudoers. - debian/postinst, debian/sudo-ldap.postinst, debian/rules: Disable init script, since in Ubuntu /var/run is a tmpfs. - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. - auth/pam.c: Abort immediately if the user presses ^C at the password prompt instead of waiting three seconds. (LP #38810, in upstream CVS) - debian/prerm: Abort package removal if there is no root password. * debian/control: Set myself as Ubuntu maintainer.	Martin Pitt	1.6.8p12-5ubuntu1	16 years ago
15	* auth/pam.c: * auth/pam.c: - Abort immediately if the user presses ^C at the password prompt instead of waiting three seconds. There is no information to be gained from doing that, and it's just annoying if one accidentally uses sudo for something. - Patch taken from upstream CVS: http://www.sudo.ws/cgi-bin/cvsweb/sudo/auth/pam.c.diff?r1=1.51&r2=1.52 - Thanks to Anders Kaseorg for the patch! - Closes: LP#38810	Martin Pitt	1.6.8p12-4ubuntu5	17 years ago
14	* debian/rules: Enable krb5 support (also add libkrb5-dev bu... * debian/rules: Enable krb5 support (also add libkrb5-dev build dependency). Closes: LP#35001. * debian/sudo_root.8: Suggest using visudo instead of editing sudoers directly. Closes: LP#47849 * debian/sudo_root.8: Mention benefit of not sharing a password. Closes: LP#48221 * sudo.c: Temporarily drop to user privileges when creating the .sudo_as_admin_successful stamp to also work on NFS with root squashing. Closes: LP#49233	Martin Pitt	1.6.8p12-4ubuntu4	17 years ago
13	* sudo.c: Disable 'def_env_reset = TRUE'. This was introduce... * sudo.c: Disable 'def_env_reset = TRUE'. This was introduced in 1.6.8p12-2 as Debian's way of treating environment variables safely. We have our own way with special treatment of unlimited sudo users, so revert this change to keep all environment variables for unlimited sudoers again. * debian/prerm: - Fix bashism and add a note why we need the slightly unusual syntax. Closes: LP#53273 - Only check the first character of the password against '!' so that we also catch disabled non-empty root passwords.	Martin Pitt	1.6.8p12-4ubuntu3	17 years ago
12	* Do not ship our pre-generated sudo.tab.c in package diff a... * Do not ship our pre-generated sudo.tab.c in package diff any more, so that it gets correctly rebuilt (automatic rebuild was added in 1.6.8p12-2). Closes: LP#51246) * debian/rules: - Remove sudo.tab.[hc] before build to make double sure that it gets regenerated correctly. - Fix rebuilding of sudo{,ers}.man.in.	Martin Pitt	1.6.8p12-4ubuntu2	17 years ago
11	[ Ongoing Merge Process ] [ Ongoing Merge Process ] Merge from debian unstable.	Scott James Remnant	1.6.8p12-4ubuntu1	17 years ago
10	env.c: Preserve additional environment variables for non-alm... env.c: Preserve additional environment variables for non-almighty sudoers: HOME, LOGNAME, DISPLAY, XAUTHORITY, XAUTHORIZATION. Closes: LP#44500	Martin Pitt	1.6.8p12-1ubuntu6	17 years ago
9	* env.c: Unbreak the env_keep option. Closes: LP#31690 * env.c: Unbreak the env_keep option. Closes: LP#31690 * sudoers: Add some explanatory text why it is a REALLY good idea to use visudo. Closes: LP#11620	Martin Pitt	1.6.8p12-1ubuntu5	18 years ago

Older »