Bug#570737: sudoedit permission in sudoers grants permission to any sudoedit, executables

2010-02-23 Thread Jan Lieskovsky
Hi guys, CVE identifier of CVE-2010-0426 has been already assigned to this issue. Thanks Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Bug#570737: sudoedit permission in sudoers grants permission to any sudoedit executables

2010-02-23 Thread neonsignal
Todd Miller has patched this in the upstream version (released as 1.7.2p4) patch to 1.6 set http://sudo.ws/repos/sudo/rev/f86e1b56d074 patch to 1.7 set http://sudo.ws/repos/sudo/rev/88f3181692fe -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of

Bug#570737: sudoedit permission in sudoers grants permission to any sudoedit executables

2010-02-20 Thread neonsignal
Package: sudo Version: 1.6.9p17-2 Severity: grave Tags: security Justification: user security hole My understanding is that permission to sudoedit is granted by a line in the sudoer file like this: user1 ALL = sudoedit /etc/network/interfaces This works as expected (because the string