Test ID:	1.3.6.1.4.1.25623.1.1.13.2023.311.01
Category:	Slackware Local Security Checks
Title:	Slackware: Security Advisory (SSA:2023-311-01)
Summary:	The remote host is missing an update for the 'sudo' package(s) announced via the SSA:2023-311-01 advisory.
Description:	Summary: The remote host is missing an update for the 'sudo' package(s) announced via the SSA:2023-311-01 advisory. Vulnerability Insight: New sudo packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/sudo-1.9.15-i586-1_slack15.0.txz: Upgraded. The sudoers plugin has been modified to make it more resilient to ROWHAMMER attacks on authentication and policy matching. The sudoers plugin now constructs the user time stamp file path name using the user-ID instead of the user name. This avoids a potential problem with user names that contain a path separator ('/') being interpreted as part of the path name. For more information, see: [links moved to references] (* Security fix *) +--------------------------+ Affected Software/OS: 'sudo' package(s) on Slackware 14.0, Slackware 14.1, Slackware 14.2, Slackware 15.0, Slackware current. Solution: Please install the updated package(s). CVSS Score: 8.5 CVSS Vector: AV:N/AC:L/Au:S/C:N/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-42456 https://ferrous-systems.com/blog/sudo-rs-audit/ https://github.com/memorysafety/sudo-rs/commit/bfdbda22968e3de43fa8246cab1681cfd5d5493d https://github.com/memorysafety/sudo-rs/security/advisories/GHSA-2r3c-m6v7-9354 http://www.openwall.com/lists/oss-security/2023/11/02/1 Common Vulnerability Exposure (CVE) ID: CVE-2023-42465 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/ https://security.gentoo.org/glsa/202401-29 https://arxiv.org/abs/2309.02545 https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f https://www.openwall.com/lists/oss-security/2023/12/21/9 https://www.sudo.ws/releases/changelog/
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.