[Forgot Password]
Login  Register Subscribe

30481

 
 

423868

 
 

255116

 
 

909

 
 

198683

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-96175-5

Platform: cpe:/o:suse:suse_linux_enterprise_server:15Date: (C)2022-09-27   (M)2023-07-04



The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password. For more information on each of the listed configurations, reference the sudoers(5) manual page.


Parameter:

[yes/no]


Technical Mechanism:

Fix:Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory: Defaults !targetpw Defaults !rootpw Defaults !runaspw

CCSS Severity:CCSS Metrics:
CCSS Score : 9.9Attack Vector: NETWORK
Exploit Score: 3.1Attack Complexity: LOW
Impact Score: 6.0Privileges Required: LOW
Severity: CRITICALUser Interaction: NONE
Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HScope: CHANGED
 Confidentiality: HIGH
 Integrity: HIGH
 Availability: HIGH
  

References:
Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:84395


OVAL    1
oval:org.secpod.oval:def:84395
XCCDF    2
xccdf_org.secpod_benchmark_general_SLES_15
xccdf_org.secpod_benchmark_SecPod_SLES_15

© SecPod Technologies