Issued:

2015-11-19

Updated:

2015-11-19

RHBA-2015:2424 - sudo bug fix and enhancement update

Synopsis

sudo bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated sudo packages that fix several bugs and add one enhancement are now available for Red Hat Enterprise Linux 7.

Description

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

This update fixes the following bug:

• Previously, the umask_override entry in the sudoers(5) manual page also, incorrectly, contained information on the use_pty flag. With this update, information on the umask_override and usy_pty flags are in separate entries as expected. (BZ#1233607)

In addition, this update adds the following enhancement:

• The configuration of the sudo utility can now store the checksum of a command or script that is being permitted. When the command or script is run again, the checksum is compared to the stored checksum to verify that nothing has changed. If the command or binary is modified, the sudo utility refuses to run the command or logs a warning. This functionality makes it possible to correctly devolve responsibility and problem-solving activities if an incident occurs. (BZ#1183818)

Users of sudo are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• sudo-debuginfo-1.8.6p7-16.el7.aarch64.rpm
• sudo-devel-1.8.6p7-16.el7.aarch64.rpm
• sudo-devel-1.8.6p7-16.el7.ppc64le.rpm
• sudo-devel-1.8.6p7-16.el7.x86_64.rpm
• sudo-debuginfo-1.8.6p7-16.el7.ppc64le.rpm
• sudo-devel-1.8.6p7-16.el7.s390.rpm
• sudo-debuginfo-1.8.6p7-16.el7.i686.rpm
• sudo-devel-1.8.6p7-16.el7.ppc64.rpm
• sudo-1.8.6p7-16.el7.aarch64.rpm
• sudo-1.8.6p7-16.el7.src.rpm
• sudo-1.8.6p7-16.el7.s390x.rpm
• sudo-debuginfo-1.8.6p7-16.el7.x86_64.rpm
• sudo-debuginfo-1.8.6p7-16.el7.ppc.rpm
• sudo-devel-1.8.6p7-16.el7.i686.rpm
• sudo-devel-1.8.6p7-16.el7.s390x.rpm
• sudo-devel-1.8.6p7-16.el7.ppc.rpm
• sudo-1.8.6p7-16.el7.ppc64le.rpm
• sudo-1.8.6p7-16.el7.ppc64.rpm
• sudo-1.8.6p7-16.el7.x86_64.rpm
• sudo-debuginfo-1.8.6p7-16.el7.ppc64.rpm
• sudo-debuginfo-1.8.6p7-16.el7.s390.rpm
• sudo-debuginfo-1.8.6p7-16.el7.s390x.rpm

Fixes

• This content is not included.BZ - 1135539
• This content is not included.BZ - 1138259
• This content is not included.BZ - 1144419
• This content is not included.BZ - 1144446
• This content is not included.BZ - 1215400

CVEs

• CVE-2014-9680

References

• http://www.redhat.com/security/updates/classification/#normal

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.