Hello community, here is the log from the commit of package sudo for openSUSE:Leap:15.2 checked in at 2020-02-25 12:16:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.2/sudo (Old) and /work/SRC/openSUSE:Leap:15.2/.sudo.new.26092 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sudo" Tue Feb 25 12:16:52 2020 rev:34 rq:778567 version:1.8.22 Changes: -------- --- /work/SRC/openSUSE:Leap:15.2/sudo/sudo.changes 2020-01-15 16:04:25.531957424 +0100 +++ /work/SRC/openSUSE:Leap:15.2/.sudo.new.26092/sudo.changes 2020-02-25 12:17:03.068416054 +0100 @@ -1,0 +2,9 @@ +Thu Feb 6 15:24:27 UTC 2020 - Kristyna Streitova <[email protected]> + +- add sudo-1.8.22-CVE-2019-18634.patch to fix a buffer overflow + when pwfeedback is enabled and input is a not a tty [bsc#1162202] + [CVE-2019-18634] +- add sudo-1.8.22-fix_listpw.patch to fix listpw=never option in + sudoers [bsc#1162675] + +------------------------------------------------------------------- New: ---- sudo-1.8.22-CVE-2019-18634.patch sudo-1.8.22-fix_listpw.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sudo.spec ++++++ --- /var/tmp/diff_new_pack.kZYlkS/_old 2020-02-25 12:17:03.760417489 +0100 +++ /var/tmp/diff_new_pack.kZYlkS/_new 2020-02-25 12:17:03.764417496 +0100 @@ -35,6 +35,8 @@ # PATCH-OPENSUSE: the "SUSE" branding of the default sudo config Patch1: sudo-sudoers.patch Patch2: sudo-CVE-2019-14287.patch +Patch3: sudo-1.8.22-CVE-2019-18634.patch +Patch4: sudo-1.8.22-fix_listpw.patch BuildRequires: audit-devel BuildRequires: cyrus-sasl-devel BuildRequires: groff ++++++ sudo-1.8.22-CVE-2019-18634.patch ++++++ >From fa8ffeb17523494f0e8bb49a25e53635f4509078 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" <[email protected]> Date: Wed, 29 Jan 2020 20:15:21 -0700 Subject: [PATCH] Fix a buffer overflow when pwfeedback is enabled and input is a not a tty. In getln() if the user enters ^U (erase line) and the write(2) fails, the remaining buffer size is reset but the current pointer is not. While here, fix an incorrect break for erase when write(2) fails. Also disable pwfeedback when input is not a tty as it cannot work. CVE-2019-18634 Credit: Joe Vennix from Apple Information Security. --- src/tgetpass.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) Index: sudo-1.8.22/src/tgetpass.c =================================================================== --- sudo-1.8.22.orig/src/tgetpass.c +++ sudo-1.8.22/src/tgetpass.c @@ -48,7 +48,7 @@ static volatile sig_atomic_t signo[NSIG] static bool tty_present(void); static void tgetpass_handler(int); -static char *getln(int, char *, size_t, int); +static char *getln(int, char *, size_t, bool); static char *sudo_askpass(const char *, const char *); static int @@ -90,6 +90,7 @@ tgetpass(const char *prompt, int timeout static const char *askpass; static char buf[SUDO_CONV_REPL_MAX + 1]; int i, input, output, save_errno, neednl = 0, need_restart; + bool feedback = ISSET(flags, TGP_MASK); debug_decl(tgetpass, SUDO_DEBUG_CONV) (void) fflush(stdout); @@ -136,7 +137,7 @@ restart: */ if (!ISSET(flags, TGP_ECHO)) { for (;;) { - if (ISSET(flags, TGP_MASK)) + if (feedback) neednl = sudo_term_cbreak(input); else neednl = sudo_term_noecho(input); @@ -150,6 +151,9 @@ restart: } } } + /* Only use feedback mode when we can disable echo. */ + if (!neednl) + feedback = false; /* * Catch signals that would otherwise cause the user to end @@ -175,7 +179,7 @@ restart: if (timeout > 0) alarm(timeout); - pass = getln(input, buf, sizeof(buf), ISSET(flags, TGP_MASK)); + pass = getln(input, buf, sizeof(buf), feedback); alarm(0); save_errno = errno; @@ -305,7 +309,7 @@ sudo_askpass(const char *askpass, const extern int sudo_term_erase, sudo_term_kill; static char * -getln(int fd, char *buf, size_t bufsiz, int feedback) +getln(int fd, char *buf, size_t bufsiz, bool feedback) { size_t left = bufsiz; ssize_t nr = -1; @@ -327,15 +331,15 @@ getln(int fd, char *buf, size_t bufsiz, while (cp > buf) { if (write(fd, "\b \b", 3) == -1) break; - --cp; + cp--; } + cp = buf; left = bufsiz; continue; } else if (c == sudo_term_erase) { if (cp > buf) { - if (write(fd, "\b \b", 3) == -1) - break; - --cp; + ignore_result(write(fd, "\b \b", 3)); + cp--; left++; } continue; ++++++ sudo-1.8.22-fix_listpw.patch ++++++ >From ecc9c366e469988c736629cbe88348c40dcfa31a Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" <[email protected]> Date: Tue, 22 Jan 2019 06:41:16 -0700 Subject: [PATCH] Fix listpw=never and verifypw=never. Bug #869 --- plugins/sudoers/parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: sudo-1.8.22/plugins/sudoers/parse.c =================================================================== --- sudo-1.8.22.orig/plugins/sudoers/parse.c +++ sudo-1.8.22/plugins/sudoers/parse.c @@ -168,7 +168,7 @@ sudo_file_lookup(struct sudo_nss *nss, i enum def_tuple pwcheck; pwcheck = (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple; - nopass = (pwcheck == all) ? true : false; + nopass = (pwcheck == never) ? true : false; if (list_pw == NULL) SET(validated, FLAG_NO_CHECK);
