hypnosec writes: A new vulnerability has been discovered in sudo whereby protection offered by the utility can be bypassed to execute commands which are otherwise only executable through sudo along with the correct password. If a few prerequisites are met; the sudo timestamp is reset using sudo -k; and system time clock is set to epoch the user can execute commands without having to enter password again. The Sudo versions that are affected by this vulnerability are 1.6.0 through to 1.7.10p6; 1.8.0 through to 1.8.6p6. Versions where the vulnerability is fixed have already been made available – 1.7.10p7 and 1.8.6p7.
Attend or create a Slashdot 20th anniversary party! DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Check out the new SourceForge HTML5 Internet speed test. ×