AIX Open Source

AIX Open Source

Share your experiences and connect with fellow developers to discover how to build and manage open source software for the AIX operating system

 View Only

  • 1.  sudo security vulnerability fix

    Posted Sat July 15, 2017 11:25 AM

    Originally posted by: sanket


    sudo-1.8.20p2 is now available on AIX toolbox.

    https://public.dhe.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/sudo/sudo-1.8.20p2-3.aix6.1.ppc.rpm

    This version has fix for following security vulnerabilities.

    CVE-2017-1000367
    CVE-2017-1000368



  • 2.  Re: sudo security vulnerability fix

    Posted Thu November 22, 2018 02:38 AM

    Originally posted by: Fasi Mohiuddin


    Hi Sanket,

    When I am trying to upgrade to fix this vulnerability, getting following message:

     

    #rpm -Uvh sudo-1.8.26-1.aix71.rpm
    package sudo-1.6.9p23-2noldap (which is newer than sudo-1.8.26-1) is already installed.

    Kindly advice.
     



  • 3.  Re: sudo security vulnerability fix

    Posted Mon November 26, 2018 02:24 AM

    Originally posted by: AyappanP


    This version sudo-1.6.9p23-2noldap has epoch/serial tag added in it so this will always be considered newer. 

    In this case, you can remove the sudo rpm (Before that make sure you take backup of sudo conf files) and install the newer version.



  • 4.  Re: sudo security vulnerability fix

    Posted Mon November 26, 2018 06:20 AM

    Originally posted by: Fasi Mohiuddin


    Hi,

    Is this file (/etc/sudoers) enough for backup or is there any other file to be backed up before removing Sudo.



  • 5.  Re: sudo security vulnerability fix

    Posted Mon November 26, 2018 07:18 AM

    Originally posted by: AyappanP


    Any files in /etc/sudoers.d directory as well.