Digniinta amniga: bug in sudo CVE-2017-1000367

Mid baa jira u nuglaanta daran ee qalabka suudo caanka ah. U nuglaanta ayaa u sabab ah cilad ku jirta barnaamijyada qalabkan oo u oggolaanaya isticmaale kasta oo kalfadhi ku leh qolofka (xitaa iyada oo la adeegsanayo SELinux) si uu u kordhiyo mudnaanta inuu xidid u noqdo. Dhibaatadu waxay ku jirtaa cillad la'aanta sudo ee ka baaraandegaysa waxyaabaha ka mid ah / proc / [PID] / stat marka la isku dayayo in la go'aamiyo barta ay ku egtahay.

Cayayaanka la helay wuxuu si gaar ah ugu jiraa wicitaanka hel_process_ttyname () sudo oo loogu talagalay Linux, taas oo ah midda fureysa tusaha aan horay u soo sheegnay si aan u aqriyo tirada qalabka tty ee qeybta tty_nr. Jilicsanaantaan oo lagu magacaabay CVE-2017-1000367 ayaa looga faa'iideysan karaa si loo helo mudnaanta nidaamka, sidaan idhi, markaa waa arrin aad u muhiim ah oo saamayn ku leh qaybo badan oo caan ah oo muhiim ah. Laakiin sidoo kale ha ka baqin, hadda waxaan kuu sheegeynaa sida loo ilaaliyo naftaada ...

Hagaag, qeybinta ay saameysay ayaa ah:

1. Red Hat Enterprise Linux 6, 7 iyo Server
2. Oracle Enterprise 6, 7 iyo Server
3. CentOS Linux 6 iyo 7
4. Debian Wheezy, Jessie, Stretch, Sid
5. Ubuntu 14.04 LTS, 16.04 LTS, 16.10 iyo 17.04
6. SuSE LInux Enterpsrise Qalabka Horumarinta Barnaamijka 12-SP2, Server loogu talagalay Raspberry Pi 12-SP2, Server 12-SP2 iyo Desktop 12-SP2
7. Furan
8. Slackware
9. Gentoo
10. Arch Linux
11. Fedora

Sidaa darteed, waa inaad balastar ama cusboonaysiin nidaamkaaga ASAP haddii aad leedahay mid ka mid ah nidaamyadan (ama kuwa deriska ah):

• Wixii Debian iyo deris ah (Ubuntu, ...):

sudo apt update

sudo apt upgrade

• Wixii loogu talagalay RHEL iyo deriska (CentOS, Oracle, ...):

sudo yum update

• Fedora:

sudo dnf update

• SuSE iyo noocyo kala duwan (OpenSUSE, ...):

sudo zypper update

Arch Linux:

sudo pacman -Syu

• Slackware:

upgradepkg sudo-1.8.20p1-i586-1_slack14.2.txz

• Gentoo:

emerge --sync

emerge --ask --oneshot --verbose ">=app-admin/sudo-1.8.20_p1"