Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3067
USN-6005-2: Sudo vulnerabilities
30 May 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Sudo
Publisher: Ubuntu
Operating System: Ubuntu
Resolution: Patch/Upgrade
CVE Names: CVE-2023-28487 CVE-2023-28486
Original Bulletin:
https://ubuntu.com/security/notices/USN-6005-2
Comment: CVSS (Max): 5.3 CVE-2023-28487 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-6005-2: Sudo vulnerabilities
29 May 2023
Several security issues were fixed in Sudo.
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and
Universe repositories, and it is free for up to five machines.
Learn more about Ubuntu Pro
Releases
o Ubuntu 16.04 ESM
Packages
o sudo - Provide limited super user privileges to specific users
Details
USN-6005-1 fixed vulnerabilities in Sudo. This update
provides the corresponding updates for Ubuntu 16.04 LTS.
Original advisory details:
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
escaped control characters in log messages and sudoreplay output. An
attacker could possibly use these issues to inject terminal control
characters that alter output when being viewed.
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and
Universe repositories, and it is free for up to five machines.
Learn more about Ubuntu Pro
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 16.04
o sudo-ldap - 1.8.16-0ubuntu1.10+esm2
Available with Ubuntu Pro
o sudo - 1.8.16-0ubuntu1.10+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
o CVE-2023-28486
o CVE-2023-28487
Related notices
o USN-6005-1 : sudo-ldap, sudo
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZHVmhskNZI30y1K9AQi72Q/9FeQO7UClkYJqccmWO1n0GdqOYBaKp2gW
yXldbuEwo3nhPLRDGMZEwnw1ZVC3iVP03AWq0urPqPGlXt+KnrJ8GTZ03EnhhlEf
629ONwjiVbb+/cMWaGqaQ40AqdjWJ150hOnU0zrqGcxbl0ygqaYcFFGUiD2oqErf
eBG7S9f7COVckpD20MFISQsFo+OXaeYjf8ux3zJHiui0nMSdsG4m/p8apA1XloCZ
2EkUtuPGwelRdU5bC0Qq9UfHLR8Ur3Vtni89jKOThDflHELHyfGBCUkusdd9bvyu
0BgbmKg93RokDq+6jNXKK1rW2ghfo6QOH2I1nkVICCBBfSB+HJxw96Ge85vcHuTi
2eYR4vSibFSLRTo3GbwdeGNHpy0Tm6fnNLB9oGCkJwgvD48Rt5eGCqir2xLVjVzo
U1Ncu4XTD7HLjYzYFrJi6RAOnptVIRSmVsQ4pQBbaSma1z2R8flRQYv6a6Tw/YLo
HjxMiDRV1zajNS8XRre+N9b/fFO1/XO7Ll0NWsbys09OiRgickQ414XO4VuQHnNh
AELV6X8OWBvLD3vp1Fv5lMm0FcrpuWga57h9a5HYrzG1VlnYHeg1rgcxidwgmRqb
IHWb3mZjTJwiYnHOz8ifODGYwrBawMpzIo0qjxNCsSxIgtPE3MVuJCjiJX720+54
g/QBDiAW5A0=
=68aZ
-----END PGP SIGNATURE-----