| Description: | Summary:
The remote host is missing an update for the 'sudo' package(s) announced via the SSA:2021-026-01 advisory.
Vulnerability Insight:
New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to
fix security issues.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/sudo-1.9.5p2-i586-1_slack14.2.txz: Upgraded.
When invoked as sudoedit, the same set of command line options
are now accepted as for 'sudo -e'. The -H and -P options are
now rejected for sudoedit and 'sudo -e' which matches the sudo
1.7 behavior. This is part of the fix for CVE-2021-3156.
Fixed a potential buffer overflow when unescaping backslashes
in the command's arguments. Normally, sudo escapes special
characters when running a command via a shell (sudo -s or sudo
-i). However, it was also possible to run sudoedit with the -s
or -i flags in which case no escaping had actually been done,
making a buffer overflow possible. This fixes CVE-2021-3156.
For more information, see:
[link moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'sudo' package(s) on Slackware 14.0, Slackware 14.1, Slackware 14.2, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
7.2
CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
