exploit the possibilities

Gentoo Linux Security Advisory 202101-33

Gentoo Linux Security Advisory 202101-33
Posted Jan 27, 2021
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202101-33 - Multiple vulnerabilities have been found in sudo, the worst of which could result in privilege escalation. Versions less than 1.9.5_p2 are affected.

tags | advisory, vulnerability
systems | linux, gentoo
advisories | CVE-2021-23239, CVE-2021-23240, CVE-2021-3156
MD5 | ee9d71dd88d18cd35844cbe4ae650331

Gentoo Linux Security Advisory 202101-33

Change Mirror Download
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202101-33
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: sudo: Multiple vulnerabilities
Date: January 26, 2021
Bugs: #764986, #767364
ID: 202101-33

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities have been found in sudo, the worst of which
could result in privilege escalation.

Background
=========
sudo (su "do") allows a system administrator to delegate authority to
give certain users (or groups of users) the ability to run some (or
all) commands as root or another user while providing an audit trail of
the commands and their arguments.

Affected packages
================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-admin/sudo < 1.9.5_p2 >= 1.9.5_p2

Description
==========
Multiple vulnerabilities have been discovered in sudo. Please review
the CVE identifiers referenced below for details.

Impact
=====
Local users are able to gain unauthorized privileges on the system or
determine the existence of files.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All sudo users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/sudo-1.9.5_p2"

References
=========
[ 1 ] CVE-2021-23239
https://nvd.nist.gov/vuln/detail/CVE-2021-23239
[ 2 ] CVE-2021-23240
https://nvd.nist.gov/vuln/detail/CVE-2021-23240
[ 3 ] CVE-2021-3156
https://nvd.nist.gov/vuln/detail/CVE-2021-3156
[ 4 ] Upstream advisory (CVE-2020-23240)
https://www.sudo.ws/alerts/sudoedit_selinux.html
[ 5 ] Upstream advisory (CVE-2021-3156)
https://www.sudo.ws/alerts/unescape_overflow.html

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202101-33

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2021 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
Login or Register to add favorites

File Archive:

March 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    19 Files
  • 2
    Mar 2nd
    15 Files
  • 3
    Mar 3rd
    30 Files
  • 4
    Mar 4th
    13 Files
  • 5
    Mar 5th
    10 Files
  • 6
    Mar 6th
    1 Files
  • 7
    Mar 7th
    2 Files
  • 8
    Mar 8th
    19 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close