SUSE-SU-2015:0985-1: moderate: Security update for sudo

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for sudo
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:0985-1
Rating:             moderate
References:         #880764 #901145 #904694 #917806 
Cross-References:   CVE-2014-9680
Affected Products:
                    SUSE Linux Enterprise Server 11 SP3 for VMware
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

   An update that solves one vulnerability and has three fixes
   is now available.

Description:


   This update for sudo provides the following fixes:

       * Handle TZ environment variable safely. (CVE-2014-9680, bnc#917806)
       * Do not truncate long commands (131072 or more characters) without
         any warning. (bnc#901145)
       * Create log files with ownership set to user and group 'root'.
         (bnc#904694)
       * Close PAM session properly. (bnc#880764)

   Security Issues:

       * CVE-2014-9680
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9680>


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11 SP3 for VMware:

      zypper in -t patch slessp3-sudo=10686

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-sudo=10686

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-sudo=10686

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

      sudo-1.7.6p2-0.23.1

   - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

      sudo-1.7.6p2-0.23.1

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

      sudo-1.7.6p2-0.23.1


References:

   https://www.suse.com/security/cve/CVE-2014-9680.html
   https://bugzilla.suse.com/880764
   https://bugzilla.suse.com/901145
   https://bugzilla.suse.com/904694
   https://bugzilla.suse.com/917806
   https://download.suse.com/patch/finder/?keywords=3f29625c93073c1ed3b6a38fb74296cb