oss-sec mailing list archives

Re: CVE request: sudo TZ issue

From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Tue, 10 Feb 2015 13:39:29 -0700

On Tue, 10 Feb 2015 13:17:59 +0100, Florian Weimer wrote:

You also need to ignore a leading : for the absolute path name check,
to match glibc behavior (and potentially others).

The code in sudo 1.8.12 handles this case correctly, but it's not clear
from the description above.


I've clarified the description in http://www.sudo.ws/alerts/tz.html

 - todd

Current thread:

CVE request: sudo TZ issue Todd C. Miller (Feb 09)
- <Possible follow-ups>
- Re: CVE request: sudo TZ issue Florian Weimer (Feb 10)
  - Re: CVE request: sudo TZ issue Todd C. Miller (Feb 10)
  - Re: CVE request: sudo TZ issue cve-assign (Feb 10)
    - Re: Re: CVE request: sudo TZ issue Florian Weimer (Feb 11)
    - Re: CVE request: sudo TZ issue cve-assign (Feb 12)
    - Re: Re: CVE request: sudo TZ issue Todd C. Miller (Feb 11)
- Re: Re: CVE request: sudo TZ issue Rich Felker (Feb 12)
  - Re: Re: CVE request: sudo TZ issue Simon McVittie (Feb 13)
  - Re: Re: CVE request: sudo TZ issue Todd C. Miller (Feb 13)