sudo might need some update

ed_whpt4 · 2021-01-28 17:44:43

Hi everyone,
Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
http://cve.mitre.org/cgi-bin/cvename.cg … -2021-3156
https://www.sudo.ws/stable.html#1.9.5p2

Scimmia · 2021-01-28 17:47:18

Since 1.9.5p2 has been in Core for two days now, what, exactly, do you think needs updated?

Last edited by Scimmia (2021-01-28 17:47:43)

ed_whpt4 · 2021-01-28 17:55:03

My pacman -Syu don't get the upgrade, I'm stuck with version 1.9.4p2.

Slithery · 2021-01-28 17:55:55

Then fix your mirrors.

Scimmia · 2021-01-28 17:58:16

1.9.5p1 was in core 8 days ago. If you're stuck on 1.9.4p2, your mirror is really, really out of date.

ed_whpt4 · 2021-01-28 18:11:09

Thank you. After adding the Worldwide mirrors the things have been better. The mistake was to rely only on France mirrors.

icar · 2021-01-28 18:23:57

@ed_whpt4 You can install and configure reflector [1] and enable its service file to keep your mirrors updated. There is also pacman-mirrorlist [2].

[1] https://archlinux.org/packages/community/any/reflector/
[2] https://archlinux.org/packages/core/any … irrorlist/

ed_whpt4 · 2021-01-28 18:39:26

pacman-mirrorlist was installed.

mpan · 2021-01-28 19:45:28

ed_whpt4 wrote:

Thank you. After adding the Worldwide mirrors the things have been better. The mistake was to rely only on France mirrors.

It has nothing to do with geographical location of the mirrors. If they are outdated, they are outdated no matter where they are.

I am mentioning this in case you are inclined to use --country and --sort=country options of reflector. Unless you have data to prove that a server in a specific country is better for you than what reflector measurements have shown⁽¹⁾, I would suggest not even touching that option.

You may also wish to look at Arch security issues page: it will tell you when updates are available, even if your mirror still misses them. There is also a community/arch-audit package, which prints information about vulnerable packages on your system and updates to them.

ed_whpt4 wrote:

pacman-mirrorlist was installed.

It’s a dependency of pacman, so it indeed must be installed.

____
⁽¹⁾ They are a bit flawed WRT latency and TCP congestion control.

Last edited by mpan (2021-01-28 19:46:36)

ed_whpt4 · 2021-01-28 20:36:45

Thank you for the advice.
I have another archlinux on another partition. It has the same mirror list the first one used to have.
pacman -Syu says the system is up-to-date.
I commented the first mirror (http://archlinux.de-labrusse.fr/), which happened to be, as stated by https://archlinux.org/mirrors/status/, out of sync.
The upgrade then proceeded correctly because the second mirror is synchronized.
This means pacman rely on the first mirror it can connect to. If it is normal behavior then the reflector package is of critical importance.

Trilby · 2021-01-28 20:48:34

ed_whpt4 wrote:

If it is normal behavior then the reflector package is of critical importance.

That is normal - and well documented - behavior. Reflector is a wonderful project, but it is most definitely not "critical". It is critical that arch users maintain their system, including their mirrorlist. Reflector is one very good way to do this. There are many others.

mpan · 2021-01-28 21:55:24

ed_whpt4: in addition to what Trilby has said: reflector is not a silver bullet either. The tool allows you to make a decision based on real (though imperfect) data, instead of relying on guesses based on intuition. But it can’t protect you from a mirror going stale. reflector will avoid such servers, but they can get out of sync later. It’s still your job as the administrator to detect the situation: for example by noticing lack of updates for a few days or missing critical updates — in particular if the official website claims the problem is already fixed.

Arch Linux

#1 2021-01-28 17:44:43

sudo might need some update

#2 2021-01-28 17:47:18

Re: sudo might need some update

#3 2021-01-28 17:55:03

Re: sudo might need some update

#4 2021-01-28 17:55:55

Re: sudo might need some update

#5 2021-01-28 17:58:16

Re: sudo might need some update

#6 2021-01-28 18:11:09

Re: sudo might need some update

#7 2021-01-28 18:23:57

Re: sudo might need some update

#8 2021-01-28 18:39:26

Re: sudo might need some update

#9 2021-01-28 19:45:28

Re: sudo might need some update

#10 2021-01-28 20:36:45

Re: sudo might need some update

#11 2021-01-28 20:48:34

Re: sudo might need some update

#12 2021-01-28 21:55:24

Re: sudo might need some update

Board footer