~ubuntu-branches/ubuntu/karmic/sudo/karmic-updates

Viewing all changes in revision 35.

  • Committer: Bazaar Package Importer
  • Author(s): Jamie Strandboge
  • Date: 2011-01-19 10:46:05 UTC
  • Revision ID: james.westby@ubuntu.com-20110119104605-kmp302oxj9er415h
Tags: 1.7.0-1ubuntu2.6
* SECURITY UPDATE: privilege escalation via -g when using group Runas_List
  - pwutil.c, sudo.h: add user_in_group(), backported from upstream commits
    48ca8c2eddf8, 72df368a8a0e and 6ebc55d4716b. This is intended to be used
    only with check.c to fix CVE-2011-0010 instead of doing the refactoring.
    Going forward, will need to look at this code also if a flaw is found in
    this refactored code. If needed, the refactoring work is in 48ca8c2eddf8
    and 6ebc55d4716b.
  - check.c: prompt for password when the user is running sudo as himself
    but as a different group. Based on fe8a94f96542.
  - CVE-2011-0010

expand all expand all

Show diffs side-by-side

added added

removed removed

Lines of Context: