~ubuntu-branches/ubuntu/lucid/sudo/lucid-updates : changes

~ubuntu-branches/ubuntu/lucid/sudo/lucid-updates » Changes from revision 43

From Revision 43 to 24

Rev	Summary	Authors	Tags	Date
43	* SECURITY UPDATE: arbitrary file access via TZ * SECURITY UPDATE: arbitrary file access via TZ - configure, configure.in, doc/sudoers.cat, doc/sudoers.man.in, pathnames.h.in, plugins/sudoers/env.c: sanity check TZ env variable. - http://www.sudo.ws/repos/sudo/rev/650ac6938b59 - http://www.sudo.ws/repos/sudo/rev/ac1467f71ac0 - http://www.sudo.ws/repos/sudo/rev/91859f613b88 - http://www.sudo.ws/repos/sudo/rev/579b02f0dbe0 - CVE-2014-9680	Marc Deslauriers	1.7.2p1-1ubuntu5.8	9 years ago
42	* SECURITY UPDATE: security policy bypass when env_reset is ... * SECURITY UPDATE: security policy bypass when env_reset is disabled - env.c: fix logic inversion - http://www.sudo.ws/repos/sudo/rev/748cefb49422 - CVE-2014-0106	Marc Deslauriers	1.7.2p1-1ubuntu5.7	10 years ago
41	* SECURITY UPDATE: authentication bypass via clock set to ep... * SECURITY UPDATE: authentication bypass via clock set to epoch - debian/patches/CVE-2013-1775.patch: ignore time stamp file if it is set to epoch in check.c. - backported from ddf399e3e306ca238f6f1cda8153889b15bba12e - CVE-2013-1775	Marc Deslauriers	1.7.2p1-1ubuntu5.6	11 years ago
40	* SECURITY UPDATE: Properly handle multiple netmasks in sudo... * SECURITY UPDATE: Properly handle multiple netmasks in sudoers Host and Host_List values - match.c: Prevent IPv6 netmask-based address matching logic from incorrectly being applied to IPv4 addresses. Based on upstream patch written by Todd C. Miller. - CVE-2012-2337	Tyler Hicks	1.7.2p1-1ubuntu5.4	11 years ago
39	* SECURITY UPDATE: privilege escalation via -g when using gr... * SECURITY UPDATE: privilege escalation via -g when using group Runas_List - pwutil.c, sudo.h: add user_in_group(), backported from upstream commits 48ca8c2eddf8, 72df368a8a0e and 6ebc55d4716b. This is intended to be used only with check.c to fix CVE-2011-0010 instead of doing the refactoring. Going forward, will need to look at this code also if a flaw is found in this refactored code. If needed, the refactoring work is in 48ca8c2eddf8 and 6ebc55d4716b. - check.c: prompt for password when the user is running sudo as himself but as a different group. Backported from fe8a94f96542. - CVE-2011-0010	Jamie Strandboge	1.7.2p1-1ubuntu5.3	13 years ago
38	* SECURITY UPDATE: privilege escalation via '-g' option when... * SECURITY UPDATE: privilege escalation via '-g' option when using 'user:group' in Runas_Spec - update match.c to verify both user and group match sudoers when using '-g'. Patch thanks to upstream. - CVE-2010-2956	Jamie Strandboge	1.7.2p1-1ubuntu5.2	13 years ago
37	* SECURITY UPDATE: properly handle multiple PATH variables w... * SECURITY UPDATE: properly handle multiple PATH variables when using secure_path in env.c - http://www.sudo.ws/repos/sudo/raw-rev/a09c6812eaec - CVE-2010-1646	Jamie Strandboge	1.7.2p1-1ubuntu5.1	13 years ago
36	* SECURITY UPDATE: properly verify path in find_path.c for t... * SECURITY UPDATE: properly verify path in find_path.c for the 'sudoedit' pseudo-command when running from the current working directory and secure_path is disabled - CVE-2010-XXXX	Jamie Strandboge	1.7.2p1-1ubuntu5	14 years ago
35	env.c: Revert addition of "http_proxy" again. This was an Ub... env.c: Revert addition of "http_proxy" again. This was an Ubuntu specific EBW hack, caused inconsistencies with other proxy variables (such as https_proxy and ftp_proxy), made sudo incompatible to upstream behaviour/documentation. This is solved in a much better way in apt itself and gnome-network-properties now. (LP: #432631)	Martin Pitt	1.7.2p1-1ubuntu4	14 years ago
34	debian/sudo.postinst, debian/sudo-ldap.postinst: update desc... debian/sudo.postinst, debian/sudo-ldap.postinst: update description to match behaviour in sudoers file. (LP: #534090)	Marc Deslauriers	1.7.2p1-1ubuntu3	14 years ago
33	* SECURITY UPDATE: properly verify path for the 'sudoedit' p... * SECURITY UPDATE: properly verify path for the 'sudoedit' pseudo-command in match.c - http://sudo.ws/repos/sudo/rev/88f3181692fe - CVE-2010-0426	Jamie Strandboge	1.7.2p1-1ubuntu2	14 years ago
32	* Merge from debian testing. Remaining changes: * Merge from debian testing. Remaining changes: - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu specific) - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. (Ubuntu specific) - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. (Ubuntu specific) - env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept for "sudo apt-get ...". (Ubuntu specific EBW hack, should disappear at some point) - debian/{rules,postinst,sudo-ldap.postinst}: Disable init script installation. Debian reintroduced it because /var/run tmpfs is not the default there, but has been on Ubuntu for ages. - debian/{source_sudo.py,rules,sudo-ldap.dirs,sudo.dirs}: Add apport hook	Marc Deslauriers	1.7.2p1-1ubuntu1	14 years ago
31	debian/{source_sudo.py,rules}: Add apport hook debian/{source_sudo.py,rules}: Add apport hook	Marc Deslauriers	1.7.0-1ubuntu3	14 years ago
30	env.c: add logic similar to pam_env's stripping of single an... env.c: add logic similar to pam_env's stripping of single and double quotes around /etc/environment env vars; fixes literal quotes in LANG when using sudo -i; LP: #387262.	Loïc Minier	1.7.0-1ubuntu2	14 years ago
29	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu specific) - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. (Ubuntu specific) - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. (Ubuntu specific) - env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept for "sudo apt-get ...". (Ubuntu specific EBW hack, should disappear at some point) - debian/{rules,postinst,sudo-ldap.postinst}: Disable init script installation. Debian reintroduced it because /var/run tmpfs is not the default there, but has been on Ubuntu for ages.	Martin Pitt	1.7.0-1ubuntu1	14 years ago
28	* SECURITY UPDATE: privilege escalation via non-default syst... * SECURITY UPDATE: privilege escalation via non-default system groups. - parse.c: upstream fix for CVE-2009-0034: http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c?r1=1.160.2.21&r2=1.160.2.22	Kees Cook	1.6.9p17-1ubuntu3	15 years ago
27	sudo.c: Drop usage of locale again, to revert back to the 1.... sudo.c: Drop usage of locale again, to revert back to the 1.6.8 behaviour. fnmatch() and glob() behave differently under different locales and thus cause undefined behaviour with (admittedly underspecified) character range globs such as "[a-Z]". Patch taken from upstream CVS, see http://www.gratisoft.us/bugzilla/show_bug.cgi?id=296 (LP: #228046)	Martin Pitt	1.6.9p17-1ubuntu2	15 years ago
26	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu specific) - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. (Ubuntu specific) - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. (Ubuntu specific) - env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept for "sudo apt-get ...". (Ubuntu specific EBW hack, should disappear at some point) * debian/{rules,postinst,sudo-ldap.postinst}: Disable init script installation. Debian reintroduced it because /var/run tmpfs is not the default there, but has been on Ubuntu for ages.	Martin Pitt	1.6.9p17-1ubuntu1	15 years ago
25	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - logging.c: Ignore SIGPIPE when creating an error email, so that non-fatal error messages (like "unable to resolve local host name") do not lead to being killed with SIGPIPE if /usr/bin/sendmail does not exist or crashes. (LP #32906, http://www.gratisoft.us/bugzilla/show_bug.cgi?id=285) - debian/postinst: put "NOPASSWD" example at the bottom, so that uncommenting it will actually work (later entries override former ones). (LP #131399, Debian #479616) - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu specific) - Add debian/sudo_root.8: Explanation of root handling through sudo. Install it in debian/rules. (Ubuntu specific) - sudo.c: If the user successfully authenticated and he is in the 'admin' group, then create a stamp ~/.sudo_as_admin_successful. Our default bash profile checks for this and displays a short intro about sudo if the flag is not present. (Ubuntu specific) - env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept for "sudo apt-get ...". (Ubuntu specific EBW hack, should disappear at some point) * debian/{rules,postinst}: Disable init script installation. Debian reintroduced it because /var/run tmpfs is not the default there, but has been on Ubuntu for ages.	Martin Pitt	1.6.9p15-2ubuntu1	15 years ago
24	debian/postinst: Fix a typo, and add a more helpful comment ... debian/postinst: Fix a typo, and add a more helpful comment about the ordering and overriding. (LP: #131399)	Martin Pitt	1.6.9p12-1ubuntu2	15 years ago

Older »