USN-2533-1: Sudo vulnerability

Releases

• Ubuntu 14.10
• Ubuntu 14.04 ESM
• Ubuntu 12.04
• Ubuntu 10.04

Packages

• sudo - Provide limited super user privileges to specific users

Details

Jakub Wilk and Stephane Chazelas discovered that Sudo incorrectly handled
the TZ environment variable. An attacker with Sudo access could possibly
use this issue to open arbitrary files, bypassing intended permissions.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.10

• sudo - 1.8.9p5-1ubuntu2.1
• sudo-ldap - 1.8.9p5-1ubuntu2.1

Ubuntu 14.04

• sudo - 1.8.9p5-1ubuntu1.1
• sudo-ldap - 1.8.9p5-1ubuntu1.1

Ubuntu 12.04

• sudo - 1.8.3p1-1ubuntu3.7
• sudo-ldap - 1.8.3p1-1ubuntu3.7

Ubuntu 10.04

• sudo - 1.7.2p1-1ubuntu5.8
• sudo-ldap - 1.7.2p1-1ubuntu5.8

In general, a standard system update will make all the necessary changes.

References

• CVE-2014-9680