/etc/sudoers can be destroyed

[Rich Johnson]

Binary package hint: smb4k

smb4k has a bug in the 0.7 releases that allows the application to change the /etc/sudoers file.

Upstream Bug:
http://developer.berlios.de/bugs/?func=detailbug&bug_id=9527&group_id=769

Package in Debian includes:
 * New upstream release
   This version fixes a grave security bug present in all 0.7 versions with
   sudoers file management.

Debian changelog:
http://packages.debian.org/changelogs/pool/main/s/smb4k/smb4k_0.7.5-1/changelog

[Kees Cook (kees)]

Thanks for putting this together!

This debdiff looks like a full diff between 0.7.1 and 0.7.5. For doing security updates, we only do minimal security patches, which should be limited to the specific problem with version 0.7.1. If you can extract, backport to 0.7.1, build, and test the fixes, then we can go from that debdiff. Since edgy is stable, we can't be doing large code changes to it, unfortunately. :(

Would you be able to isolate the specific patch that fixes the problem and give it some testing?

[Rich Johnson (nixternal)]

Hey Kees,

Just checking the status on this bug for Edgy? Dapper is supposedly fine as this issue only happened with the .7.x releases. Thanks again for the help.

[Kees Cook (kees)]

Basically, this is on hold until someone can produce a debdiff that contains only the security fixes. Also, since this bug is really only a problem for people that can already "su", so it's pretty low priority as I understand it.

[Kees Cook (kees)]

Rejecting devel task, marking as an Edgy task.

[William Grant (wgrant)]

Edgy is EOL.