|
|
|
 |
Vulnerability Note VU#424358sudoedit can expose protected file contentsOverviewSudo's -e option (sudoedit) improperly handles temporary files, allowing an attacker to read files that would otherwise be inaccessible.I. DescriptionSudo is a utility that allows specific users to run certain commands as root. Beginning with version 1.6.8, sudo provides safe editing functionality via sudoedit. Sudoedit allows specific users to edit certain files as root, as specified by the sudoers configuration file.When sudoedit launches the specified editor, it reopens a temporary copy of the file to be edited with root privileges. If this temporary file is changed to be a symlink to a file with restricted access, the editor will display the contents of the file with restricted access.
For vendor-specific information regarding vulnerable status and patch availability, please see the vendor section of this document.
References
This vulnerability was reported by Reznic Valery. This document was written by Will Dormann and is based on the information in the Sudo Alert .
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Get Adobe Reader