mailing list archives
Re: Advisory: sudo 1.8 Format String Vulnerability
From: Agostino Sarubbo <ago () gentoo org>
Date: Mon, 30 Jan 2012 20:38:25 +0100
On Monday 30 January 2012 20:01:36 Henri Salo wrote:
On Mon, Jan 30, 2012 at 02:56:26PM +0100, joernchen of Phenoelit wrote:
FYI, see attached.
This seems to be CVE-2012-0809 and reported to Gentoo as
I reported it on gentoo bugzilla, but trusting upstream advisory, since gentoo
compiles as default with -D_FORTIFY_SOURCE=2, seems unaffected.
However, upstream advisory and joernchen advisory seems not the same.
The first says:
adding -D_FORTIFY_SOURCE=2 to the OSDEFS line in src/Makfile and rebuilding
sudo will prevent the bug from being exploited.
The second says:
he above example shows the result of FORTIFY_SOURCE which makes explotitation
painful but not impossible (see ). Without FORTIFY_SOURCE the exploit is
something should be corrected?
Agostino Sarubbo ago -at- gentoo.org
Gentoo/AMD64 Arch Security Liaison
Description: This is a digitally signed message part.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/