USN-8895-2: Sudo vulnerability
USN-8895-1 fixed a vulnerability in Sudo. This update provides the corresponding updates for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by manipulating the TZ environment variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/sudoto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/sudo-ldapto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-8895-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected Sudo packages on Ubuntu 18.04 LTS or Ubuntu 20.04 LTS are exposed when their sudoers rules use NOTBEFORE or NOTAFTER timestamps that omit the trailing timezone indicator.
What does an attacker need to exploit it?
The attacker needs local access and the ability to manipulate the TZ environment variable. Exploitation could allow commands to run outside the time window intended by the affected sudoers rule.
How can I determine whether my configuration is affected?
Review sudoers rules for NOTBEFORE or NOTAFTER restrictions with timestamps that omit a trailing timezone indicator. Rules without those time-based restrictions are not described as affected by this advisory.