[Savannah-hackers] address@hidden: [SECURITY] [DSA-128-1] sudo buffer overflow]

[Mark H. Weaver]

------- Start of forwarded message -------
Envelope-to: address@hidden
Delivery-date: Thu, 25 Apr 2002 19:14:46 -0400
X-Envelope-Sender: address@hidden
Date: Fri, 26 Apr 2002 01:13:21 +0200
From: Wichert Akkerman <address@hidden>
To: address@hidden
Mail-Followup-To: address@hidden
Content-Disposition: inline
X-Debian: PGP check passed for security officers
Subject: [SECURITY] [DSA-128-1] sudo buffer overflow
Priority: urgent
Reply-To: address@hidden
X-Spam-Status: No, hits=-5.0 required=4.7 tests=PGP_SIGNATURE version=2.01
Resent-From: address@hidden
X-Mailing-List: <address@hidden> 
X-Loop: address@hidden
Resent-Sender: address@hidden
Resent-Bcc:

- -----BEGIN PGP SIGNED MESSAGE-----

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-128-1                   address@hidden
http://www.debian.org/security/                         Wichert Akkerman
April 26, 2002
- - ------------------------------------------------------------------------


Package        : sudo
Problem type   : buffer overflow
Debian-specific: no

fc found a buffer overflow in the variable expansion code
used by sudo for its prompt. Since sudo is necessarily installed suid
root a local user can use this to gain root access.

This has been fixed in version 1.6.2-2.2 and we recommend that you upgrade
your sudo package immediately.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
- - ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

  Source archives:
    
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.diff.gz
      MD5 checksum: 958560c409b43bd13463b3d380fc534a
    
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2-2.2.dsc
      MD5 checksum: 7323f0f3614513156120ccc4772524f8
    
http://security.debian.org/dists/stable/updates/main/source/sudo_1.6.2p2.orig.tar.gz
      MD5 checksum: dd5944c880fd5cc56bc0f0199e92d2b4

  Alpha architecture:
    
http://security.debian.org/dists/stable/updates/main/binary-alpha/sudo_1.6.2p2-2.2_alpha.deb
      MD5 checksum: 66cb0d4f730560fddba65e44dd78c34d

  ARM architecture:
    
http://security.debian.org/dists/stable/updates/main/binary-arm/sudo_1.6.2p2-2.2_arm.deb
      MD5 checksum: f74bae46ebd07bd8f430261153d13f90

  Intel IA-32 architecture:
    
http://security.debian.org/dists/stable/updates/main/binary-i386/sudo_1.6.2p2-2.2_i386.deb
      MD5 checksum: 9ac9b91818dd7b2f2888aa39aac0da98

  Motorola 680x0 architecture:
    
http://security.debian.org/dists/stable/updates/main/binary-m68k/sudo_1.6.2p2-2.2_m68k.deb
      MD5 checksum: 46f6d595363d23c96701cd303511e1a5

  PowerPC architecture:
    
http://security.debian.org/dists/stable/updates/main/binary-powerpc/sudo_1.6.2p2-2.2_powerpc.deb
      MD5 checksum: 66c23d2544e9a8f19c57c919a4a751c9

  Sun Sparc architecture:
    
http://security.debian.org/dists/stable/updates/main/binary-sparc/sudo_1.6.2p2-2.2_sparc.deb
      MD5 checksum: 9654ecac0230abe0f28524469fb5887e

  These packages will be moved into the stable distribution on its next
  revision.

- - -- 
- - ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: address@hidden

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBPMiNiqjZR/ntlUftAQErEwL/Xi3i/N5tGqezLTsuJlgChy6MLnX7gJG4
cMa5MzW+1xUH39xz6JAgPKQv9C4FyPqgEOOwa5xt/0vkNasj8ARiu/avLM4Uk6uS
22t9YWRjlnP4tPIi4DPhv20LFu1jeSNH
=0Rd2
- -----END PGP SIGNATURE-----


- -- 
To UNSUBSCRIBE, email to address@hidden
with a subject of "unsubscribe". Trouble? Contact address@hidden
------- End of forwarded message -------