ID CVE-2013-2777
Summary sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
References
Vulnerable Configurations
  • Apple Mac OS X 10.10.4
    cpe:2.3:o:apple:mac_os_x:10.10.4
  • Todd Miller Sudo 1.7.10
    cpe:2.3:a:todd_miller:sudo:1.7.10
  • Todd Miller Sudo 1.7.9p1
    cpe:2.3:a:todd_miller:sudo:1.7.9p1
  • Todd Miller Sudo 1.7.9
    cpe:2.3:a:todd_miller:sudo:1.7.9
  • Todd Miller Sudo 1.7.8p2
    cpe:2.3:a:todd_miller:sudo:1.7.8p2
  • Todd Miller Sudo 1.7.8p1
    cpe:2.3:a:todd_miller:sudo:1.7.8p1
  • Todd Miller Sudo 1.7.8
    cpe:2.3:a:todd_miller:sudo:1.7.8
  • Todd Miller Sudo 1.7.7
    cpe:2.3:a:todd_miller:sudo:1.7.7
  • Todd Miller Sudo 1.7.6p2
    cpe:2.3:a:todd_miller:sudo:1.7.6p2
  • Todd Miller Sudo 1.7.6p1
    cpe:2.3:a:todd_miller:sudo:1.7.6p1
  • Todd Miller Sudo 1.7.6
    cpe:2.3:a:todd_miller:sudo:1.7.6
  • Todd Miller Sudo 1.7.5
    cpe:2.3:a:todd_miller:sudo:1.7.5
  • Todd Miller Sudo 1.7.4p5
    cpe:2.3:a:todd_miller:sudo:1.7.4p5
  • Todd Miller Sudo 1.7.4p2
    cpe:2.3:a:todd_miller:sudo:1.7.4p2
  • Todd Miller Sudo 1.7.4p3
    cpe:2.3:a:todd_miller:sudo:1.7.4p3
  • Todd Miller Sudo 1.7.4
    cpe:2.3:a:todd_miller:sudo:1.7.4
  • Todd Miller Sudo 1.7.4p1
    cpe:2.3:a:todd_miller:sudo:1.7.4p1
  • Todd Miller Sudo 1.7.4p4
    cpe:2.3:a:todd_miller:sudo:1.7.4p4
  • Todd Miller Sudo 1.7.4p6
    cpe:2.3:a:todd_miller:sudo:1.7.4p6
  • Todd Miller Sudo 1.7.3b1
    cpe:2.3:a:todd_miller:sudo:1.7.3b1
  • Todd Miller Sudo 1.7.2p6
    cpe:2.3:a:todd_miller:sudo:1.7.2p6
  • Todd Miller Sudo 1.7.2p5
    cpe:2.3:a:todd_miller:sudo:1.7.2p5
  • Todd Miller Sudo 1.7.2p4
    cpe:2.3:a:todd_miller:sudo:1.7.2p4
  • Todd Miller Sudo 1.7.2p2
    cpe:2.3:a:todd_miller:sudo:1.7.2p2
  • Todd Miller Sudo 1.7.2p3
    cpe:2.3:a:todd_miller:sudo:1.7.2p3
  • Todd Miller Sudo 1.7.2
    cpe:2.3:a:todd_miller:sudo:1.7.2
  • Todd Miller Sudo 1.7.2p1
    cpe:2.3:a:todd_miller:sudo:1.7.2p1
  • Todd Miller Sudo 1.7.2p7
    cpe:2.3:a:todd_miller:sudo:1.7.2p7
  • Todd Miller Sudo 1.7.1
    cpe:2.3:a:todd_miller:sudo:1.7.1
  • Todd Miller Sudo 1.7.0
    cpe:2.3:a:todd_miller:sudo:1.7.0
  • Todd Miller Sudo 1.6.9p23
    cpe:2.3:a:todd_miller:sudo:1.6.9p23
  • Todd Miller Sudo 1.6.5
    cpe:2.3:a:todd_miller:sudo:1.6.5
  • Todd Miller Sudo 1.6.4p2
    cpe:2.3:a:todd_miller:sudo:1.6.4p2
  • Todd Miller Sudo 1.6.9p20
    cpe:2.3:a:todd_miller:sudo:1.6.9p20
  • Todd Miller Sudo 1.6.9p21
    cpe:2.3:a:todd_miller:sudo:1.6.9p21
  • Todd Miller Sudo 1.6.4
    cpe:2.3:a:todd_miller:sudo:1.6.4
  • Todd Miller Sudo 1.6.8
    cpe:2.3:a:todd_miller:sudo:1.6.8
  • Todd Miller Sudo 1.6.6
    cpe:2.3:a:todd_miller:sudo:1.6.6
  • Todd Miller Sudo 1.6.7
    cpe:2.3:a:todd_miller:sudo:1.6.7
  • Todd Miller Sudo 1.6.9p22
    cpe:2.3:a:todd_miller:sudo:1.6.9p22
  • Todd Miller Sudo 1.6.2p3
    cpe:2.3:a:todd_miller:sudo:1.6.2p3
  • Todd Miller Sudo 1.6.7p5
    cpe:2.3:a:todd_miller:sudo:1.6.7p5
  • Todd Miller Sudo 1.6.8p12
    cpe:2.3:a:todd_miller:sudo:1.6.8p12
  • Todd Miller Sudo 1.6.3 p7
    cpe:2.3:a:todd_miller:sudo:1.6.3_p7
  • Todd Miller Sudo 1.6.9
    cpe:2.3:a:todd_miller:sudo:1.6.9
  • Todd Miller Sudo 1.6
    cpe:2.3:a:todd_miller:sudo:1.6
  • Todd Miller Sudo 1.6.1
    cpe:2.3:a:todd_miller:sudo:1.6.1
  • Todd Miller Sudo 1.6.2
    cpe:2.3:a:todd_miller:sudo:1.6.2
  • Todd Miller Sudo 1.6.3
    cpe:2.3:a:todd_miller:sudo:1.6.3
  • cpe:2.3:a:todd_miller:sudo:1.3.5
    cpe:2.3:a:todd_miller:sudo:1.3.5
  • Todd Miller Sudo 1.7.10p1
    cpe:2.3:a:todd_miller:sudo:1.7.10p1
  • Todd Miller Sudo 1.7.10p2
    cpe:2.3:a:todd_miller:sudo:1.7.10p2
  • Todd Miller Sudo 1.7.10p3
    cpe:2.3:a:todd_miller:sudo:1.7.10p3
  • Todd Miller Sudo 1.7.10p4
    cpe:2.3:a:todd_miller:sudo:1.7.10p4
  • Todd Miller Sudo 1.8.0
    cpe:2.3:a:todd_miller:sudo:1.8.0
  • Todd Miller Sudo 1.8.1
    cpe:2.3:a:todd_miller:sudo:1.8.1
  • Todd Miller Sudo 1.8.1p1
    cpe:2.3:a:todd_miller:sudo:1.8.1p1
  • Todd Miller Sudo 1.8.1p2
    cpe:2.3:a:todd_miller:sudo:1.8.1p2
  • Todd Miller Sudo 1.8.2
    cpe:2.3:a:todd_miller:sudo:1.8.2
  • Todd Miller Sudo 1.8.3
    cpe:2.3:a:todd_miller:sudo:1.8.3
  • Todd Miller Sudo 1.8.3p1
    cpe:2.3:a:todd_miller:sudo:1.8.3p1
  • Todd Miller Sudo 1.8.3p2
    cpe:2.3:a:todd_miller:sudo:1.8.3p2
  • Todd Miller Sudo 1.8.4
    cpe:2.3:a:todd_miller:sudo:1.8.4
  • Todd Miller Sudo 1.8.4p1
    cpe:2.3:a:todd_miller:sudo:1.8.4p1
  • Todd Miller Sudo 1.8.4p2
    cpe:2.3:a:todd_miller:sudo:1.8.4p2
  • Todd Miller Sudo 1.8.4p3
    cpe:2.3:a:todd_miller:sudo:1.8.4p3
  • Todd Miller Sudo 1.8.4p4
    cpe:2.3:a:todd_miller:sudo:1.8.4p4
  • Todd Miller Sudo 1.8.4p5
    cpe:2.3:a:todd_miller:sudo:1.8.4p5
  • Todd Miller Sudo 1.8.5
    cpe:2.3:a:todd_miller:sudo:1.8.5
  • Todd Miller Sudo 1.8.6
    cpe:2.3:a:todd_miller:sudo:1.8.6
  • Todd Miller Sudo 1.8.6p1
    cpe:2.3:a:todd_miller:sudo:1.8.6p1
  • Todd Miller Sudo 1.8.6p2
    cpe:2.3:a:todd_miller:sudo:1.8.6p2
  • Todd Miller Sudo 1.8.6p3
    cpe:2.3:a:todd_miller:sudo:1.8.6p3
  • Todd Miller Sudo 1.8.6p4
    cpe:2.3:a:todd_miller:sudo:1.8.6p4
  • Todd Miller Sudo 1.8.6p5
    cpe:2.3:a:todd_miller:sudo:1.8.6p5
CVSS
Base: 4.4 (as of 30-03-2016 - 15:10)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201401-23.NASL
    description The remote host is affected by the vulnerability described in GLSA-201401-23 (sudo: Privilege escalation) Multiple vulnerabilities have been found in sudo: sudo does not correctly validate the controlling terminal on a system without /proc or when the tty_tickets option is enabled. sudo does not properly handle the clock when it is set to the epoch. Impact : A local attacker with sudo privileges could connect to the stdin, stdout, and stderr of the terminal of a user who has authenticated with sudo, allowing the attacker to hijack the authorization of the other user. Additionally, a local or physically proximate attacker could set the system clock to the epoch, bypassing time restrictions on sudo authentication. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 72078
    published 2014-01-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72078
    title GLSA-201401-23 : sudo: Privilege escalation
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_10_5.NASL
    description The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - Apple ID OD Plug-in - AppleGraphicsControl - Bluetooth - bootp - CloudKit - CoreMedia Playback - CoreText - curl - Data Detectors Engine - Date & Time pref pane - Dictionary Application - DiskImages - dyld - FontParser - groff - ImageIO - Install Framework Legacy - IOFireWireFamily - IOGraphics - IOHIDFamily - Kernel - Libc - Libinfo - libpthread - libxml2 - libxpc - mail_cmds - Notification Center OSX - ntfs - OpenSSH - OpenSSL - perl - PostgreSQL - python - QL Office - Quartz Composer Framework - Quick Look - QuickTime 7 - SceneKit - Security - SMBClient - Speech UI - sudo - tcpdump - Text Formats - udf Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 85408
    published 2015-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85408
    title Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2642.NASL
    description Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-1775 Marco Schoepl discovered an authentication bypass when the clock is set to the UNIX epoch [00:00:00 UTC on 1 January 1970]. - CVE-2013-1776 Ryan Castellucci and James Ogden discovered aspects of an issue that would allow session id hijacking from another authorized tty.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65179
    published 2013-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65179
    title Debian DSA-2642-1 : sudo - several issues
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SUDO-8562.NASL
    description This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775 / CVE-2013-1776 / CVE-2013-2776 / CVE-2013-2777.
    last seen 2019-02-21
    modified 2014-02-10
    plugin id 66466
    published 2013-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66466
    title SuSE 10 Security Update : sudo (ZYPP Patch Number 8562)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1701.NASL
    description From Red Hat Security Advisory 2013:1701 : An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements : * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 71112
    published 2013-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71112
    title Oracle Linux 6 : sudo (ELSA-2013-1701)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2013-065-01.NASL
    description New sudo packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.
    last seen 2019-02-21
    modified 2018-06-27
    plugin id 65060
    published 2013-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65060
    title Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : sudo (SSA:2013-065-01)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20131121_SUDO_ON_SL6_X.NASL
    description A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : - Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. - When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. - Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. - Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. In addition, this update adds the following enhancements : - With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. - With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 71300
    published 2013-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71300
    title Scientific Linux Security Update : sudo on SL6.x i386/x86_64
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1701.NASL
    description An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements : * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79173
    published 2014-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79173
    title CentOS 6 : sudo (CESA-2013:1701)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_SUDO-130430.NASL
    description This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775 / CVE-2013-1776 / CVE-2013-2776 / CVE-2013-2777.
    last seen 2019-02-21
    modified 2014-02-10
    plugin id 66464
    published 2013-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66464
    title SuSE 11.2 Security Update : sudo (SAT Patch Number 7705)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2016-0079.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when env_reset is disabled Resolves: rhbz#1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 (CVE-2013-2776) CVE-2013-2777 Resolves: rhbz#968221 - visudo: fixed incorrect warning and parse error regarding undefined aliases which were in fact defined Resolves: rhbz#849679 Resolves: rhbz#905624 - updated sudoers man-page to clarify the behavior of the user negation operator and the behavior of wildcard matching in command specifications Resolves: rhbz#846118 Resolves: rhbz#856902 - fixed regression in escaping of sudo -i arguments Resolves: rhbz#853203 - bump release number - Fixed caching of user and group names - Backported RFC 4515 escaping of LDAP queries Resolves: rhbz#855836 Resolves: rhbz#869287 - Add the -c option to sed commands in post/postun scripts Resolves: rhbz#818585 - Implement a new sudoers Defaults option to restore old command exec behavior Resolves: rhbz#840971 - Add ability to treat files authoritatively in sudoers.ldap Resolves: rhbz#840097 - Changed policycoreutils dependency to a context specific dependency (post & postun) Resolves: rhbz#846694 - don't use a temporary file when modifying nsswitch.conf - fix permissions on nsswitch.conf, if needed Resolves: rhbz#846631 - added a workaround for a race condition in handling child processes Resolves: rhbz#829263 - use safe temporary files in post/postun scripts - corrected postun script Resolves: rhbz#841070 - corrected release number - call restorecon after modifying nsswitch.conf in the postun scriplet - added policycoreutils dependency Resolves: rhbz#818585 - fixed `sudo -i' command escaping (#806073) - fixed multiple sudoHost LDAP attr. handlng (#740884) Resolves: rhbz#740884 Resolves: rhbz#806073
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 91755
    published 2016-06-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=91755
    title OracleVM 3.2 : sudo (OVMSA-2016-0079)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1701.NASL
    description An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements : * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 71017
    published 2013-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71017
    title RHEL 6 : sudo (RHSA-2013:1701)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-259.NASL
    description A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776 , CVE-2013-2777)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 71399
    published 2013-12-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71399
    title Amazon Linux AMI : sudo (ALAS-2013-259)
redhat via4
advisories
bugzilla
id 994626
title sudo -l show error: *** glibc detected *** sudo: realloc(): invalid next size: 0x00007f4ae2d10ec0 ***
oval
AND
  • OR
    • comment Red Hat Enterprise Linux 6 Client is installed
      oval oval:com.redhat.rhba:tst:20111656001
    • comment Red Hat Enterprise Linux 6 Server is installed
      oval oval:com.redhat.rhba:tst:20111656002
    • comment Red Hat Enterprise Linux 6 Workstation is installed
      oval oval:com.redhat.rhba:tst:20111656003
    • comment Red Hat Enterprise Linux 6 ComputeNode is installed
      oval oval:com.redhat.rhba:tst:20111656004
  • OR
    • AND
      • comment sudo is earlier than 0:1.8.6p3-12.el6
        oval oval:com.redhat.rhsa:tst:20131701005
      • comment sudo is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhba:tst:20130363006
    • AND
      • comment sudo-devel is earlier than 0:1.8.6p3-12.el6
        oval oval:com.redhat.rhsa:tst:20131701007
      • comment sudo-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhba:tst:20130363008
rhsa
id RHSA-2013:1701
released 2013-11-21
severity Low
title RHSA-2013:1701: sudo security, bug fix and enhancement update (Low)
rpms
  • sudo-0:1.8.6p3-12.el6
  • sudo-devel-0:1.8.6p3-12.el6
refmap via4
apple APPLE-SA-2015-08-13-2
bid 58207
confirm
debian DSA-2642
misc
mlist [oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints
slackware SSA:2013-065-01
xf sudo-ttytickets-sec-bypass(82453)
Last major update 30-03-2016 - 17:54
Published 08-04-2013 - 13:55
Last modified 28-08-2017 - 21:33
Back to Top