4821 matches found
Debian Security Advisory DSA 101-1 (sudo)
The remote host is missing an update to sudo announced via advisory DSA 101-1. OpenVAS Vulnerability Test $Id: deb1011.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 101-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...
Debian Security Advisory DSA 870-1 (sudo)
The remote host is missing an update to sudo announced via advisory DSA 870-1. Tavis Ormandy noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. The SHELLOPTS and PS4 variables are dangerous and are still passed...
Debian Security Advisory DSA 946-1 (sudo)
The remote host is missing an update to sudo announced via advisory DSA 946-1. It has been discovered that sudo, a privileged program, that provides limited super user privileges to specific users, passes several environment variables to the program that runs with elevated privileges. In the case...
Debian Security Advisory DSA 596-1 (sudo)
The remote host is missing an update to sudo announced via advisory DSA 596-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Debian: Security Advisory (DSA-870-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DSA-596-2)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DSA-735-2)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Race condition
Multiple race conditions in the 1 Sudo monitor mode and 2 Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing...
CVE-2007-4305
Multiple race conditions in the 1 Sudo monitor mode and 2 Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing...
CVE-2007-4305
Multiple race conditions in the 1 Sudo monitor mode and 2 Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing...
CVE-2007-4305
CVE-2007-4305 involves multiple race conditions in the Sudo monitor mode and in Sysjail policies of Systrace on NetBSD and OpenBSD. The underlying issue allows local users to defeat system call interposition, thereby bypassing access control policy and auditing. Affected components: NetBSD/OpenBS...
Design/Logic Flaw
sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...
CVE-2007-3149
sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...
CVE-2007-3149
sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...
CVE-2007-3149
CVE-2007-3149 concerns the sudo utility when linked with MIT Kerberos 5 (krb5). The vulnerability arises because sudo does not properly verify whether a user is currently authenticated to Kerberos, allowing local users to gain privileges via certain KRB5_ environment variable settings. The issue ...
CVE-2007-3149
sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...
CVE-2007-3149
sudo, when linked with MIT Kerberos 5 krb5, does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5 environment variable settings. NOTE: another researcher...
MIT krb5: makes sudo authentication issue MUCH worse.
On Wed, Jun 06, 2007 at 11:19:01PM -0400, Thor Lancelot Simon wrote: On Wed, Jun 06, 2007 at 09:57:25PM -0400, Thor Lancelot Simon wrote: But woe betide any system administrator who accidentally puts a Kerberos-enabled sudo on a host that's configured as a Kerberos client only! Actually, if you...
Sudo: local root compromise with krb5 enabled
The 'sudo' package can be built to use Kerberos 5 for authentication of users. When a user is properly authenticated to sudo, sudo grants that user potentially limited root privileges. Thus a mistake in the authentication code in sudo is potentially severe: it can lead to a local root compromise...