sudo: sudo spits out lots of crap on STDOUT

[Debian Bug Importer]

Automatically imported from Debian bug report #282786 http://bugs.debian.org/282786

[Debian Bug Importer (debzilla)]

Automatically imported from Debian bug report #282786 http://bugs.debian.org/282786

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Wed, 24 Nov 2004 15:11:04 +0100
From: =?iso-8859-1?Q?Frank_K=FCster?= <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: sudo: sudo spits out lots of crap on STDOUT

Package: sudo
Version: 1.6.6-1.2
Severity: grave

Since today's security update for woody, sudo spits out lots of
"Looking at .." messages on stdout. This is not only extremely
annoying for me - it also makes it harder to grep through the output
of commands called via sudo, and breaks existing scripts
(numofsomething=`sudo $command | wc -l`...)

This is what it does here:

frank@alhambra:~$ sudo /usr/sbin/runq 2>&1
Looking at PWD=/home/frank...
Looking at WRASTER_COLOR_RESOLUTION0=4...
Looking at COLORFGBG=0;15...
Looking at WINDOWID=14680066...
Looking at GRACE_EDITOR=/usr/bin/X11/xedit...
Looking at LC_MESSAGES=C...
Looking at LESSCLOSE=/usr/bin/lesspipe '%s' '%s'...
Looking at LS_OPTIONS=--color=auto...
Looking at LESSOPEN=|lesspipe %s...
Looking at myoldpwd=...
Looking at GNUSTEP_USER_ROOT=/home/frank/GNUstep...
Looking at USER=frank...
Looking at LS_COLORS=no=00:fi=00:di=01;34:ln=01;36:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.gz=01;31:*.bz2=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.mpg=01;35:*.mpeg=01;35:*.avi=01;35:*.fli=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.ogg=01;35:*.mp3=01;35:*.wav=01;35:...
Looking at LC_TYPE=de_DE@euro...
Looking at OLDPWD=/home/frank/src/packages_for_mydebwork/perl-doc-html...
Looking at doku=/usr/share/doc...
Looking at CVS_RSH=ssh...
Looking at EDITOR=emacs...
Looking at LANG=de_DE@euro...
Looking at LC_NUMERIC=C...
Looking at COLORTERM=rxvt...
Looking at DISPLAY=:0.0...
Looking at LOGNAME=frank...
Looking at SHLVL=2...
Looking at SSH_AGENT_PID=2155...
Looking at TEXINPUTS=:./bilder...
Looking at MM_CHARSET=ISO-8859-15...
Looking at SHELL=/bin/bash...
Looking at CVSROOT=/var/lib/cvs...
Looking at HOME=/home/frank...
Looking at TERM=rxvt...
Looking at PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games:/home/frank/bin:/home/frank/bin...
Looking at WMAKER_BIN_NAME=/usr/bin/WindowMaker...
Looking at _=/usr/bin/sudo...

-- System Information
Debian Release: 3.0-bunk-2
Architecture: i386
Kernel: Linux alhambra 2.4.27 #1 Sam Sep 25 11:29:41 CEST 2004 i686
Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro

Versions of packages sudo depends on:
ii libc6 2.2.5-11.5 GNU C Library: Shared libraries an
ii libpam-modules 0.72-35 Pluggable Authentication Modules f
ii libpam0g 0.76-14.99.jones.1 Pluggable Authentication Modules l

[Daniel Stone (daniels)]

Not present in the Ubuntu security update.

[Frank Küster (frank-kuesterei)]

Dear Security team,

this bug report should have a Cc to you in the first place, excuse me
Bdale.

Frank Küster <email address hidden> wrote:

> Package: sudo
> Version: 1.6.6-1.2
> Severity: grave
>
> Since today's security update for woody, sudo spits out lots of
> "Looking at .." messages on stdout. This is not only extremely
> annoying for me - it also makes it harder to grep through the output
> of commands called via sudo, and breaks existing scripts
> (numofsomething=`sudo $command | wc -l`...)
>
> This is what it does here:
[...]

There are two other bugs on that which I didn't see before submitting
(#282777, #282778); I am not merging because these are "important", but
I think it should continue to be "grave" - it breaks existing local
scripts.

Regards, Frank
--
Frank Küster
Inst. f. Biochemie der Univ. Zürich
Debian Developer

[Steve Kemp (skx)]

tags 282777 +grave +pending +security -important
tags 282778 +grave +pending +security -important
tags 282786 +grave +pending +security -important
merge 282777 282778 282786
stop

Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit

[Steve Kemp (skx)]

On Wed, Nov 24, 2004 at 04:53:01PM +0100, Frank K?ster wrote:

> > Since today's security update for woody, sudo spits out lots of
> > "Looking at .." messages on stdout. This is not only extremely
> > annoying for me - it also makes it harder to grep through the output
> > of commands called via sudo, and breaks existing scripts
> > (numofsomething=`sudo $command | wc -l`...)
> >
> > This is what it does here:
> [...]
>
> There are two other bugs on that which I didn't see before submitting
> (#282777, #282778); I am not merging because these are "important", but
> I think it should continue to be "grave" - it breaks existing local
> scripts.

  I've merged them all, and set the 'pending' tag. A new upload will
 be made shortly to correct this problem.

Steve
--

[Martin Schulze (joey-infodrom)]

Frank Küster wrote:
> Dear Security team,
>
> this bug report should have a Cc to you in the first place, excuse me
> Bdale.
>
> Frank Küster <email address hidden> wrote:
>
> > Package: sudo
> > Version: 1.6.6-1.2
> > Severity: grave
> >
> > Since today's security update for woody, sudo spits out lots of
> > "Looking at .." messages on stdout. This is not only extremely
> > annoying for me - it also makes it harder to grep through the output
> > of commands called via sudo, and breaks existing scripts
> > (numofsomething=`sudo $command | wc -l`...)
> >
> > This is what it does here:
> [...]
>
> There are two other bugs on that which I didn't see before submitting
> (#282777, #282778); I am not merging because these are "important", but
> I think it should continue to be "grave" - it breaks existing local
> scripts.

Nah, it just spits too much output. It doesn't break.
Waiting only for mips and s390...

Regards,

 Joey

--
WARNING: Do not execute! This call violates patent DE10108564.
http://www.elug.de/projekte/patent-party/patente/DE10108564

wget -O patinfo-`date +"%Y%m%d"`.html http://patinfo.ffii.org/

[Steve Kemp (skx)]

tags 282777 + pending security important
tags 282778 + pending security important
tags 282786 + pending security important
tags 282786 - grave
merge 282777 282778 282786
end

--
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit

[Frank Küster (frank-kuesterei)]

Martin Schulze <email address hidden> wrote:

>>
>> There are two other bugs on that which I didn't see before submitting
>> (#282777, #282778); I am not merging because these are "important", but
>> I think it should continue to be "grave" - it breaks existing local
>> scripts.
>
> Nah, it just spits too much output. It doesn't break.

It doesn't break itself, but it will surely break scripts that rely on
the traditional behavior of sudo and parse the output of commands called
via sudo.

> Waiting only for mips and s390...

You mean, you are compiling a fixed sudo version?

Regards, Frank
--
Frank Küster
Inst. f. Biochemie der Univ. Zürich
Debian Developer

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 16:53:01 +0100
From: <email address hidden> (=?iso-8859-1?q?Frank_K=FCster?=)
To: <email address hidden>
Cc: <email address hidden>
Subject: Re: sudo: sudo spits out lots of crap on STDOUT

Dear Security team,

this bug report should have a Cc to you in the first place, excuse me
Bdale.=20

Frank K=FCster <email address hidden> wrote:

> Package: sudo
> Version: 1.6.6-1.2
> Severity: grave
>
> Since today's security update for woody, sudo spits out lots of
> "Looking at .." messages on stdout. This is not only extremely
> annoying for me - it also makes it harder to grep through the output
> of commands called via sudo, and breaks existing scripts
> (numofsomething=3D`sudo $command | wc -l`...)
>
> This is what it does here:
[...]

There are two other bugs on that which I didn't see before submitting
(#282777, #282778); I am not merging because these are "important", but
I think it should continue to be "grave" - it breaks existing local
scripts.=20

Regards, Frank
--=20
Frank K=FCster
Inst. f. Biochemie der Univ. Z=FCrich
Debian Developer

[Martin Schulze (joey-infodrom)]

Frank Küster wrote:
> > Waiting only for mips and s390...
>
> You mean, you are compiling a fixed sudo version?

Yes, built the last two packages on my own due to er... busy buildds.
Update in 5 minutes.

Regards,

 Joey

--
WARNING: Do not execute! This call violates patent DE10108564.
http://www.elug.de/projekte/patent-party/patente/DE10108564

wget -O patinfo-`date +"%Y%m%d"`.html http://patinfo.ffii.org/

[Steve Kemp (skx)]

tags 282777 + pending security
tags 282778 + pending security
tags 282786 + pending security

severity 282777 important
severity 282778 important
severity 282786 important

merge 282777 282778 282786
stop
end

Grr I will get this right. Take three.

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 16:17:11 +0000
From: Steve Kemp <email address hidden>
To: Frank K?ster <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: sudo: sudo spits out lots of crap on STDOUT

On Wed, Nov 24, 2004 at 04:53:01PM +0100, Frank K?ster wrote:

> > Since today's security update for woody, sudo spits out lots of
> > "Looking at .." messages on stdout. This is not only extremely
> > annoying for me - it also makes it harder to grep through the output
> > of commands called via sudo, and breaks existing scripts
> > (numofsomething=`sudo $command | wc -l`...)
> >
> > This is what it does here:
> [...]
>
> There are two other bugs on that which I didn't see before submitting
> (#282777, #282778); I am not merging because these are "important", but
> I think it should continue to be "grave" - it breaks existing local
> scripts.

  I've merged them all, and set the 'pending' tag. A new upload will
 be made shortly to correct this problem.

Steve
--

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 17:22:13 +0100
From: Martin Schulze <email address hidden>
To: Frank =?iso-8859-1?Q?K=FCster?= <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: sudo: sudo spits out lots of crap on STDOUT

Frank K=FCster wrote:
> Dear Security team,
>=20
> this bug report should have a Cc to you in the first place, excuse me
> Bdale.=20
>=20
> Frank K=FCster <email address hidden> wrote:
>=20
> > Package: sudo
> > Version: 1.6.6-1.2
> > Severity: grave
> >
> > Since today's security update for woody, sudo spits out lots of
> > "Looking at .." messages on stdout. This is not only extremely
> > annoying for me - it also makes it harder to grep through the output
> > of commands called via sudo, and breaks existing scripts
> > (numofsomething=3D`sudo $command | wc -l`...)
> >
> > This is what it does here:
> [...]
>=20
> There are two other bugs on that which I didn't see before submitting
> (#282777, #282778); I am not merging because these are "important", but
> I think it should continue to be "grave" - it breaks existing local
> scripts.=20

Nah, it just spits too much output. It doesn't break.
Waiting only for mips and s390...

Regards,

 Joey

--=20
WARNING: Do not execute! This call violates patent DE10108564.
http://www.elug.de/projekte/patent-party/patente/DE10108564

wget -O patinfo-`date +"%Y%m%d"`.html http://patinfo.ffii.org/

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 16:16:36 +0000
From: Steve Kemp <email address hidden>
To: <email address hidden>

tags 282777 +grave +pending +security -important
tags 282778 +grave +pending +security -important
tags 282786 +grave +pending +security -important
merge 282777 282778 282786
stop

Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 17:35:59 +0100
From: <email address hidden> (=?iso-8859-1?q?Frank_K=FCster?=)
To: Martin Schulze <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: sudo: sudo spits out lots of crap on STDOUT

Martin Schulze <email address hidden> wrote:

>>=20
>> There are two other bugs on that which I didn't see before submitting
>> (#282777, #282778); I am not merging because these are "important", but
>> I think it should continue to be "grave" - it breaks existing local
>> scripts.=20
>
> Nah, it just spits too much output. It doesn't break.

It doesn't break itself, but it will surely break scripts that rely on
the traditional behavior of sudo and parse the output of commands called
via sudo.

> Waiting only for mips and s390...

You mean, you are compiling a fixed sudo version?

Regards, Frank
--=20
Frank K=FCster
Inst. f. Biochemie der Univ. Z=FCrich
Debian Developer

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 16:37:18 +0000
From: Steve Kemp <email address hidden>
To: <email address hidden>

tags 282777 + pending security important
tags 282778 + pending security important
tags 282786 + pending security important
tags 282786 - grave
merge 282777 282778 282786
end

--
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 17:55:48 +0100
From: Martin Schulze <email address hidden>
To: Frank =?iso-8859-1?Q?K=FCster?= <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: sudo: sudo spits out lots of crap on STDOUT

Frank K=FCster wrote:
> > Waiting only for mips and s390...
>=20
> You mean, you are compiling a fixed sudo version?

Yes, built the last two packages on my own due to er... busy buildds.
Update in 5 minutes.

Regards,

 Joey

--=20
WARNING: Do not execute! This call violates patent DE10108564.
http://www.elug.de/projekte/patent-party/patente/DE10108564

wget -O patinfo-`date +"%Y%m%d"`.html http://patinfo.ffii.org/

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Nov 2004 16:57:16 +0000
From: Steve Kemp <email address hidden>
To: <email address hidden>

tags 282777 + pending security
tags 282778 + pending security
tags 282786 + pending security

severity 282777 important
severity 282778 important
severity 282786 important

merge 282777 282778 282786
stop
end

Grr I will get this right. Take three.

[Bdale Garbee (bdale)]

Martin Schulze <email address hidden> writes:

> Yes, built the last two packages on my own due to er... busy buildds.
> Update in 5 minutes.

Thanks for following up on this.

Bdale

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Sat, 27 Nov 2004 16:15:45 -0700
From: Bdale Garbee <email address hidden>
To: Martin Schulze <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#282786: sudo: sudo spits out lots of crap on STDOUT

Martin Schulze <email address hidden> writes:

> Yes, built the last two packages on my own due to er... busy buildds.
> Update in 5 minutes.

Thanks for following up on this.

Bdale

[Bdale Garbee (bdale)]

I believe these were fixed by the upload of 1.6.6-1.3 which is now in stable.

Bdale

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Sat, 26 Mar 2005 21:29:05 -0700 (MST)
From: <email address hidden> (Bdale Garbee)
To: <email address hidden>, <email address hidden>,
 <email address hidden>
Subject: fixed

I believe these were fixed by the upload of 1.6.6-1.3 which is now in stable.

Bdale