Originally posted by: sanket

sudo-1.8.20p2 is now available on AIX toolbox.

https://public.dhe.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/sudo/sudo-1.8.20p2-3.aix6.1.ppc.rpm

This version has fix for following security vulnerabilities.

CVE-2017-1000367
CVE-2017-1000368

Originally posted by: Fasi Mohiuddin

Hi Sanket,

When I am trying to upgrade to fix this vulnerability, getting following message:

#rpm -Uvh sudo-1.8.26-1.aix71.rpm
package sudo-1.6.9p23-2noldap (which is newer than sudo-1.8.26-1) is already installed.

Kindly advice.
 

Originally posted by: AyappanP

This version sudo-1.6.9p23-2noldap has epoch/serial tag added in it so this will always be considered newer. 

In this case, you can remove the sudo rpm (Before that make sure you take backup of sudo conf files) and install the newer version.

Originally posted by: Fasi Mohiuddin

Hi,

Is this file (/etc/sudoers) enough for backup or is there any other file to be backed up before removing Sudo.

Originally posted by: AyappanP

Any files in /etc/sudoers.d directory as well.