Format string vulnerability found in 'sudo'

Re:Format string vulnerability found in 'sudo' by morsch on Monday January 30, 2012 @03:24PM (#3530495)

Affected versions are 1.8.0 through 1.8.3p1 inclusive. Ubuntu 11.10 is not affected (it's running 1.7.4). Ubuntu 12.04 (alpha) might be, which appears to be running 1.8.3p1, for a short while anyway.

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by dpritchett on Monday January 30, 2012 @04:10PM (#3530675)

Ubuntu 10.04 LTS seems to be OK:

  $ lsb_release -a
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 10.04.3 LTS
  Release:        10.04
  Codename:       lucid

  $ sudo -V
  Sudo version 1.7.2p1

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by mcclung on Monday January 30, 2012 @06:04PM (#3530997)

Super. My gentoo boxes are 1.8.2, and are broken as expected.

  $ ln -s /usr/bin/sudo ./%s
  $ ./%s -D9
  [some debug output with garbage]
  Segmentation fault
  $

Bug is here:

https://bugs.gentoo.org/show_bug.cgi?id=401533

Looks like it's patched on x86/amd64 already.

OpenIndiana looks unaffected. It's using 1.7.4p4.

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by vangale on Monday January 30, 2012 @07:32PM (#3531221)

Yep patch is in Gentoo, I just did a sync and 1.8.3_p2 will be built.

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by sho_hn on Monday January 30, 2012 @03:28PM (#3530516)

Debian stable is unaffected (1.7.4p4).

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by legooolas on Tuesday January 31, 2012 @10:44AM (#3533686)

Debian _un_stable, on the other hand may be (depending on when you last updated). There is a new package available and so an `apt-get install sudo' or `apt-get upgrade' will sort it.

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by waitwhat on Monday January 30, 2012 @03:47PM (#3530590)

CentOS 6.2 (and hence RHEL 6.2, the current version) is on sudo-1.7.4p5.

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by rwmj on Monday January 30, 2012 @04:16PM (#3530685)

RHEL compiled out the debugging support and is NOT vulnerable.

Fedora compiles everything with -DFORTIFY_SOURCE which means this still crashes, but is not (thought to be) vulnerable. In any case there is an update available for Fedora right now. https://admin.fedoraproject.org/updates/sudo-1.8.3p1-2.fc16

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by gurkendoktor on Tuesday January 31, 2012 @02:46AM (#3532290)

On OS X 10.7.2: Sudo version 1.7.4p6, on the latest 10.6: 1.7.0.

[ Parent | on HN ]

Re:Format string vulnerability found in 'sudo' by andrewcooke on Monday January 30, 2012 @09:14PM (#3531491)

segfaults on opensuse 12.1 (1.8.2).

[ Parent | on HN ]