Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14287: CVE-2017-1000368: It was found that the original fix for CVE-2017-1000367 was incomplete. A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. 99999: CVE-2017-1000368 sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367) CVE-2017-1000367: A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. 99999: CVE-2017-1000367 sudo: Privilege escalation in via improper get_process_ttyname() parsing
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | sudo | 0:1.8.23-4.amzn2.0.1 |
| Amazon Linux · 2 | sudo-debuginfo | 0:1.8.23-4.amzn2.0.1 |
| Amazon Linux · 2 | sudo-devel | 0:1.8.23-4.amzn2.0.1 |
Vulnerabilities 3
-
Unscored —CVE-2017-1000367 Public exploit
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process…
-
Unscored —
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_pro…
-
Unscored —
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and s…