← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/sudo/oneiric-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2011-0010.patch

  • Committer: Package Import Robot
  • Author(s): Tyler Hicks
  • Date: 2012-05-15 23:28:04 UTC
  • Revision ID: package-import@ubuntu.com-20120515232804-2rd0d4k222la647h
Tags: 1.7.4p6-1ubuntu2.1
* SECURITY UPDATE: Properly handle multiple netmasks in sudoers Host and
  Host_List values
  - debian/patches/CVE-2012-2337.patch: Don't perform IPv6 checks on IPv4
    addresses. Based on upstream patch.
  - CVE-2012-2337

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2011-0010.patch
1
 
Origin: http://www.sudo.ws/repos/sudo/raw-rev/fe8a94f96542
2
 
Description: fix CVE-2011-0010 by prompting for password when the user is
3
 
 running sudo as himself but as a different group
4
 
 
5
 
Index: sudo-1.7.4p4/check.c
6
 
===================================================================
7
 
--- sudo-1.7.4p4.orig/check.c   2011-01-18 16:33:03.000000000 -0600
8
 
+++ sudo-1.7.4p4/check.c        2011-01-18 16:33:17.000000000 -0600
9
 
@@ -119,7 +119,13 @@
10
 
     if (ISSET(mode, MODE_INVALIDATE)) {
11
 
        SET(validated, FLAG_CHECK_USER);
12
 
     } else {
13
 
-       if (user_uid == 0 || user_uid == runas_pw->pw_uid || user_is_exempt())
14
 
+       /*
15
 
+        * Don't prompt for the root passwd or if the user is exempt.
16
 
+        * If the user is not changing uid/gid, no need for a password.
17
 
+        */
18
 
+       if (user_uid == 0 || (user_uid == runas_pw->pw_uid &&
19
 
+           (!runas_gr || user_in_group(sudo_user.pw, runas_gr->gr_name))) ||
20
 
+           user_is_exempt())
21
 
            return;
22
 
     }
23