ID CVE-2013-1775
Summary sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.
References
Vulnerable Configurations
  • Todd Miller Sudo 1.6.9p22
    cpe:2.3:a:todd_miller:sudo:1.6.9p22
  • Todd Miller Sudo 1.6.2p3
    cpe:2.3:a:todd_miller:sudo:1.6.2p3
  • Todd Miller Sudo 1.6.9p23
    cpe:2.3:a:todd_miller:sudo:1.6.9p23
  • Todd Miller Sudo 1.6.5
    cpe:2.3:a:todd_miller:sudo:1.6.5
  • Todd Miller Sudo 1.6.4p2
    cpe:2.3:a:todd_miller:sudo:1.6.4p2
  • Todd Miller Sudo 1.6.9p20
    cpe:2.3:a:todd_miller:sudo:1.6.9p20
  • Todd Miller Sudo 1.6.9p21
    cpe:2.3:a:todd_miller:sudo:1.6.9p21
  • Todd Miller Sudo 1.6.7p5
    cpe:2.3:a:todd_miller:sudo:1.6.7p5
  • Todd Miller Sudo 1.6.4
    cpe:2.3:a:todd_miller:sudo:1.6.4
  • Todd Miller Sudo 1.6.8p12
    cpe:2.3:a:todd_miller:sudo:1.6.8p12
  • Todd Miller Sudo 1.6.3 p7
    cpe:2.3:a:todd_miller:sudo:1.6.3_p7
  • Todd Miller Sudo 1.6.9
    cpe:2.3:a:todd_miller:sudo:1.6.9
  • Todd Miller Sudo 1.6
    cpe:2.3:a:todd_miller:sudo:1.6
  • Todd Miller Sudo 1.6.8
    cpe:2.3:a:todd_miller:sudo:1.6.8
  • Todd Miller Sudo 1.6.1
    cpe:2.3:a:todd_miller:sudo:1.6.1
  • Todd Miller Sudo 1.6.6
    cpe:2.3:a:todd_miller:sudo:1.6.6
  • Todd Miller Sudo 1.6.2
    cpe:2.3:a:todd_miller:sudo:1.6.2
  • Todd Miller Sudo 1.6.7
    cpe:2.3:a:todd_miller:sudo:1.6.7
  • Todd Miller Sudo 1.6.3
    cpe:2.3:a:todd_miller:sudo:1.6.3
  • Todd Miller Sudo 1.8.0
    cpe:2.3:a:todd_miller:sudo:1.8.0
  • Todd Miller Sudo 1.8.1
    cpe:2.3:a:todd_miller:sudo:1.8.1
  • Todd Miller Sudo 1.8.1p1
    cpe:2.3:a:todd_miller:sudo:1.8.1p1
  • Todd Miller Sudo 1.8.1p2
    cpe:2.3:a:todd_miller:sudo:1.8.1p2
  • Todd Miller Sudo 1.8.2
    cpe:2.3:a:todd_miller:sudo:1.8.2
  • Todd Miller Sudo 1.8.3
    cpe:2.3:a:todd_miller:sudo:1.8.3
  • Todd Miller Sudo 1.8.3p1
    cpe:2.3:a:todd_miller:sudo:1.8.3p1
  • Todd Miller Sudo 1.8.3p2
    cpe:2.3:a:todd_miller:sudo:1.8.3p2
  • Todd Miller Sudo 1.8.4
    cpe:2.3:a:todd_miller:sudo:1.8.4
  • Todd Miller Sudo 1.8.4p1
    cpe:2.3:a:todd_miller:sudo:1.8.4p1
  • Todd Miller Sudo 1.8.4p2
    cpe:2.3:a:todd_miller:sudo:1.8.4p2
  • Todd Miller Sudo 1.8.4p3
    cpe:2.3:a:todd_miller:sudo:1.8.4p3
  • Todd Miller Sudo 1.8.4p4
    cpe:2.3:a:todd_miller:sudo:1.8.4p4
  • Todd Miller Sudo 1.8.4p5
    cpe:2.3:a:todd_miller:sudo:1.8.4p5
  • Todd Miller Sudo 1.8.5
    cpe:2.3:a:todd_miller:sudo:1.8.5
  • Todd Miller Sudo 1.8.5p1
    cpe:2.3:a:todd_miller:sudo:1.8.5p1
  • Todd Miller Sudo 1.8.5p2
    cpe:2.3:a:todd_miller:sudo:1.8.5p2
  • Todd Miller Sudo 1.8.5p3
    cpe:2.3:a:todd_miller:sudo:1.8.5p3
  • Todd Miller Sudo 1.8.6
    cpe:2.3:a:todd_miller:sudo:1.8.6
  • Todd Miller Sudo 1.8.6p1
    cpe:2.3:a:todd_miller:sudo:1.8.6p1
  • Todd Miller Sudo 1.8.6p2
    cpe:2.3:a:todd_miller:sudo:1.8.6p2
  • Todd Miller Sudo 1.8.6p3
    cpe:2.3:a:todd_miller:sudo:1.8.6p3
  • Todd Miller Sudo 1.8.6p4
    cpe:2.3:a:todd_miller:sudo:1.8.6p4
  • Todd Miller Sudo 1.8.6p5
    cpe:2.3:a:todd_miller:sudo:1.8.6p5
  • Todd Miller Sudo 1.8.6p6
    cpe:2.3:a:todd_miller:sudo:1.8.6p6
  • Apple Mac OS X 10.10.4
    cpe:2.3:o:apple:mac_os_x:10.10.4
  • Todd Miller Sudo 1.7.2p2
    cpe:2.3:a:todd_miller:sudo:1.7.2p2
  • Todd Miller Sudo 1.7.2p3
    cpe:2.3:a:todd_miller:sudo:1.7.2p3
  • Todd Miller Sudo 1.7.3b1
    cpe:2.3:a:todd_miller:sudo:1.7.3b1
  • Todd Miller Sudo 1.7.2
    cpe:2.3:a:todd_miller:sudo:1.7.2
  • Todd Miller Sudo 1.7.4p5
    cpe:2.3:a:todd_miller:sudo:1.7.4p5
  • Todd Miller Sudo 1.7.2p6
    cpe:2.3:a:todd_miller:sudo:1.7.2p6
  • Todd Miller Sudo 1.7.2p1
    cpe:2.3:a:todd_miller:sudo:1.7.2p1
  • Todd Miller Sudo 1.7.2p5
    cpe:2.3:a:todd_miller:sudo:1.7.2p5
  • Todd Miller Sudo 1.7.0
    cpe:2.3:a:todd_miller:sudo:1.7.0
  • Todd Miller Sudo 1.7.2p4
    cpe:2.3:a:todd_miller:sudo:1.7.2p4
  • Todd Miller Sudo 1.7.1
    cpe:2.3:a:todd_miller:sudo:1.7.1
  • Todd Miller Sudo 1.7.4p4
    cpe:2.3:a:todd_miller:sudo:1.7.4p4
  • Todd Miller Sudo 1.7.2p7
    cpe:2.3:a:todd_miller:sudo:1.7.2p7
  • Todd Miller Sudo 1.7.4p2
    cpe:2.3:a:todd_miller:sudo:1.7.4p2
  • Todd Miller Sudo 1.7.4p3
    cpe:2.3:a:todd_miller:sudo:1.7.4p3
  • Todd Miller Sudo 1.7.4
    cpe:2.3:a:todd_miller:sudo:1.7.4
  • Todd Miller Sudo 1.7.4p1
    cpe:2.3:a:todd_miller:sudo:1.7.4p1
  • Todd Miller Sudo 1.7.4p6
    cpe:2.3:a:todd_miller:sudo:1.7.4p6
  • Todd Miller Sudo 1.7.5
    cpe:2.3:a:todd_miller:sudo:1.7.5
  • Todd Miller Sudo 1.7.6
    cpe:2.3:a:todd_miller:sudo:1.7.6
  • Todd Miller Sudo 1.7.6p1
    cpe:2.3:a:todd_miller:sudo:1.7.6p1
  • Todd Miller Sudo 1.7.6p2
    cpe:2.3:a:todd_miller:sudo:1.7.6p2
  • Todd Miller Sudo 1.7.7
    cpe:2.3:a:todd_miller:sudo:1.7.7
  • Todd Miller Sudo 1.7.8
    cpe:2.3:a:todd_miller:sudo:1.7.8
  • Todd Miller Sudo 1.7.8p1
    cpe:2.3:a:todd_miller:sudo:1.7.8p1
  • Todd Miller Sudo 1.7.8p2
    cpe:2.3:a:todd_miller:sudo:1.7.8p2
  • Todd Miller Sudo 1.7.9
    cpe:2.3:a:todd_miller:sudo:1.7.9
  • Todd Miller Sudo 1.7.9p1
    cpe:2.3:a:todd_miller:sudo:1.7.9p1
  • Todd Miller Sudo 1.7.10
    cpe:2.3:a:todd_miller:sudo:1.7.10
  • Todd Miller Sudo 1.7.10p1
    cpe:2.3:a:todd_miller:sudo:1.7.10p1
  • Todd Miller Sudo 1.7.10p2
    cpe:2.3:a:todd_miller:sudo:1.7.10p2
  • Todd Miller Sudo 1.7.10p3
    cpe:2.3:a:todd_miller:sudo:1.7.10p3
  • Todd Miller Sudo 1.7.10p4
    cpe:2.3:a:todd_miller:sudo:1.7.10p4
  • Todd Miller Sudo 1.7.10p5
    cpe:2.3:a:todd_miller:sudo:1.7.10p5
  • Todd Miller Sudo 1.7.10p6
    cpe:2.3:a:todd_miller:sudo:1.7.10p6
CVSS
Base: 6.9 (as of 30-03-2016 - 15:13)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
  • description OSX <= 10.8.4 - Local Root Privilege Escalation (py). CVE-2013-1775. Local exploit for osx platform
    id EDB-ID:27965
    last seen 2016-02-03
    modified 2013-08-30
    published 2013-08-30
    reporter David Kennedy (ReL1K)
    source https://www.exploit-db.com/download/27965/
    title OSX <= 10.8.4 - Local Root Privilege Escalation py
  • description Mac OS X Sudo Password Bypass. CVE-2013-1775. Local exploit for osx platform
    id EDB-ID:27944
    last seen 2016-02-03
    modified 2013-08-29
    published 2013-08-29
    reporter metasploit
    source https://www.exploit-db.com/download/27944/
    title Mac OS X Sudo Password Bypass
metasploit via4
description This module gains a session with root permissions on versions of OS X with sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4, and possibly lower versions. If your session belongs to a user with Administrative Privileges (the user is in the sudoers file and is in the "admin group"), and the user has ever run the "sudo" command, it is possible to become the super user by running `sudo -k` and then resetting the system clock to 01-01-1970. This module will fail silently if the user is not an admin, if the user has never run the sudo command, or if the admin has locked the Date/Time preferences. Note: If the user has locked the Date/Time preferences, requests to overwrite the system clock will be ignored, and the module will silently fail. However, if the "Require an administrator password to access locked preferences" setting is not enabled, the Date/Time preferences are often unlocked every time the admin logs in, so you can install persistence and wait for a chance later.
id MSF:EXPLOIT/OSX/LOCAL/SUDO_PASSWORD_BYPASS
last seen 2018-09-07
modified 2018-05-31
published 2013-08-24
reliability Normal
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb
title Mac OS X Sudo Password Bypass
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_10_5.NASL
    description The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - Apple ID OD Plug-in - AppleGraphicsControl - Bluetooth - bootp - CloudKit - CoreMedia Playback - CoreText - curl - Data Detectors Engine - Date & Time pref pane - Dictionary Application - DiskImages - dyld - FontParser - groff - ImageIO - Install Framework Legacy - IOFireWireFamily - IOGraphics - IOHIDFamily - Kernel - Libc - Libinfo - libpthread - libxml2 - libxpc - mail_cmds - Notification Center OSX - ntfs - OpenSSH - OpenSSL - perl - PostgreSQL - python - QL Office - Quartz Composer Framework - Quick Look - QuickTime 7 - SceneKit - Security - SMBClient - Speech UI - sudo - tcpdump - Text Formats - udf Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2018-09-02
    modified 2018-07-16
    plugin id 85408
    published 2015-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85408
    title Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2013-065-01.NASL
    description New sudo packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.
    last seen 2018-09-02
    modified 2018-06-27
    plugin id 65060
    published 2013-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65060
    title Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : sudo (SSA:2013-065-01)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SUDO-8562.NASL
    description This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775 / CVE-2013-1776 / CVE-2013-2776 / CVE-2013-2777.
    last seen 2018-09-02
    modified 2014-02-10
    plugin id 66466
    published 2013-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66466
    title SuSE 10 Security Update : sudo (ZYPP Patch Number 8562)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1701.NASL
    description From Red Hat Security Advisory 2013:1701 : An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements : * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2018-09-01
    modified 2018-07-18
    plugin id 71112
    published 2013-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71112
    title Oracle Linux 6 : sudo (ELSA-2013-1701)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-259.NASL
    description A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776 , CVE-2013-2777)
    last seen 2018-09-02
    modified 2018-04-18
    plugin id 71399
    published 2013-12-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71399
    title Amazon Linux AMI : sudo (ALAS-2013-259)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1353.NASL
    description From Red Hat Security Advisory 2013:1353 : An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776) This update also fixes the following bugs : * Due to a bug in the cycle detection algorithm of the visudo utility, visudo incorrectly evaluated certain alias definitions in the /etc/sudoers file as cycles. Consequently, a warning message about undefined aliases appeared. This bug has been fixed, /etc/sudoers is now parsed correctly by visudo and the warning message no longer appears. (BZ#849679) * Previously, the 'sudo -l' command did not parse the /etc/sudoers file correctly if it contained an Active Directory (AD) group. The file was parsed only up to the first AD group information and then the parsing failed with the following message : sudo: unable to cache group ADDOM\admingroup, already exists With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly. (BZ#855836) * Previously, the sudo utility did not escape the backslash characters contained in user names properly. Consequently, if a system used sudo integrated with LDAP or Active Directory (AD) as the primary authentication mechanism, users were not able to authenticate on that system. With this update, sudo has been modified to process LDAP and AD names correctly and the authentication process now works as expected. (BZ#869287) * Prior to this update, the 'visudo -s (strict)' command incorrectly parsed certain alias definitions. Consequently, an error message was issued. The bug has been fixed, and parsing errors no longer occur when using 'visudo -s'. (BZ#905624) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues.
    last seen 2018-09-02
    modified 2015-12-01
    plugin id 70288
    published 2013-10-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70288
    title Oracle Linux 5 : sudo (ELSA-2013-1353)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1701.NASL
    description An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements : * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2018-11-11
    modified 2018-11-10
    plugin id 79173
    published 2014-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79173
    title CentOS 6 : sudo (CESA-2013:1701)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20131121_SUDO_ON_SL6_X.NASL
    description A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : - Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. - When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. - Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. - Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. In addition, this update adds the following enhancements : - With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. - With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups.
    last seen 2018-09-01
    modified 2014-02-10
    plugin id 71300
    published 2013-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71300
    title Scientific Linux Security Update : sudo on SL6.x i386/x86_64
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2642.NASL
    description Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-1775 Marco Schoepl discovered an authentication bypass when the clock is set to the UNIX epoch [00:00:00 UTC on 1 January 1970]. - CVE-2013-1776 Ryan Castellucci and James Ogden discovered aspects of an issue that would allow session id hijacking from another authorized tty.
    last seen 2018-11-11
    modified 2018-11-10
    plugin id 65179
    published 2013-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65179
    title Debian DSA-2642-1 : sudo - several issues
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-054.NASL
    description Multiple vulnerabilities has been found and corrected in sudo : A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated netmask listed in the sudoers file or in LDAP. As a result, users authorized to run commands on certain IP networks may be able to run commands on hosts that belong to other networks not explicitly listed in sudoers (CVE-2012-2337). sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically-proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch (CVE-2013-1775). Sudo before 1.8.6p7 allows a malicious user to run commands via sudo without authenticating, so long as there exists a terminal the user has access to where a sudo command was successfully run by that same user within the password timeout period (usually five minutes) (CVE-2013-1776). The updated packages have been patched to correct these issues.
    last seen 2018-09-02
    modified 2018-07-19
    plugin id 66068
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66068
    title Mandriva Linux Security Advisory : sudo (MDVSA-2013:054)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_SUDO-130430.NASL
    description This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775 / CVE-2013-1776 / CVE-2013-2776 / CVE-2013-2777.
    last seen 2018-09-01
    modified 2014-02-10
    plugin id 66464
    published 2013-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66464
    title SuSE 11.2 Security Update : sudo (SAT Patch Number 7705)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130930_SUDO_ON_SL5_X.NASL
    description A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776) This update also fixes the following bugs : - Due to a bug in the cycle detection algorithm of the visudo utility, visudo incorrectly evaluated certain alias definitions in the /etc/sudoers file as cycles. Consequently, a warning message about undefined aliases appeared. This bug has been fixed, /etc/sudoers is now parsed correctly by visudo and the warning message no longer appears. - Previously, the 'sudo -l' command did not parse the /etc/sudoers file correctly if it contained an Active Directory (AD) group. The file was parsed only up to the first AD group information and then the parsing failed with the following message : sudo: unable to cache group ADDOM\admingroup, already exists With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly. - Previously, the sudo utility did not escape the backslash characters contained in user names properly. Consequently, if a system used sudo integrated with LDAP or Active Directory (AD) as the primary authentication mechanism, users were not able to authenticate on that system. With this update, sudo has been modified to process LDAP and AD names correctly and the authentication process now works as expected. - Prior to this update, the 'visudo -s (strict)' command incorrectly parsed certain alias definitions. Consequently, an error message was issued. The bug has been fixed, and parsing errors no longer occur when using 'visudo - -s'.
    last seen 2018-09-01
    modified 2014-02-10
    plugin id 70392
    published 2013-10-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70392
    title Scientific Linux Security Update : sudo on SL5.x i386/x86_64
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_764344FB821411E29273902B343DEEC9.NASL
    description Todd Miller reports : The flaw may allow someone with physical access to a machine that is not password-protected to run sudo commands without knowing the logged in user's password. On systems where sudo is the principal way of running commands as root, such as on Ubuntu and Mac OS X, there is a greater chance that the logged in user has run sudo before and thus that an attack would succeed.
    last seen 2018-11-22
    modified 2018-11-21
    plugin id 64987
    published 2013-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64987
    title FreeBSD : sudo -- Authentication bypass when clock is reset (764344fb-8214-11e2-9273-902b343deec9)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-221.NASL
    description sudo was updated to fix two security issues, where adjusting the time of the syste could be used to regain access to sudo sessions if they onc were granted. (CVE-2013-1775,CVE-2013-1776)
    last seen 2018-11-13
    modified 2018-11-10
    plugin id 74928
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74928
    title openSUSE Security Update : sudo (openSUSE-SU-2013:0495-1)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2016-0079.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - added patch for CVE-2014-0106: certain environment variables not sanitized when env_reset is disabled Resolves: rhbz#1072210 - backported fixes for CVE-2013-1775 CVE-2013-1776 (CVE-2013-2776) CVE-2013-2777 Resolves: rhbz#968221 - visudo: fixed incorrect warning and parse error regarding undefined aliases which were in fact defined Resolves: rhbz#849679 Resolves: rhbz#905624 - updated sudoers man-page to clarify the behavior of the user negation operator and the behavior of wildcard matching in command specifications Resolves: rhbz#846118 Resolves: rhbz#856902 - fixed regression in escaping of sudo -i arguments Resolves: rhbz#853203 - bump release number - Fixed caching of user and group names - Backported RFC 4515 escaping of LDAP queries Resolves: rhbz#855836 Resolves: rhbz#869287 - Add the -c option to sed commands in post/postun scripts Resolves: rhbz#818585 - Implement a new sudoers Defaults option to restore old command exec behavior Resolves: rhbz#840971 - Add ability to treat files authoritatively in sudoers.ldap Resolves: rhbz#840097 - Changed policycoreutils dependency to a context specific dependency (post & postun) Resolves: rhbz#846694 - don't use a temporary file when modifying nsswitch.conf - fix permissions on nsswitch.conf, if needed Resolves: rhbz#846631 - added a workaround for a race condition in handling child processes Resolves: rhbz#829263 - use safe temporary files in post/postun scripts - corrected postun script Resolves: rhbz#841070 - corrected release number - call restorecon after modifying nsswitch.conf in the postun scriplet - added policycoreutils dependency Resolves: rhbz#818585 - fixed `sudo -i' command escaping (#806073) - fixed multiple sudoHost LDAP attr. handlng (#740884) Resolves: rhbz#740884 Resolves: rhbz#806073
    last seen 2018-09-01
    modified 2018-07-24
    plugin id 91755
    published 2016-06-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=91755
    title OracleVM 3.2 : sudo (OVMSA-2016-0079)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201401-23.NASL
    description The remote host is affected by the vulnerability described in GLSA-201401-23 (sudo: Privilege escalation) Multiple vulnerabilities have been found in sudo: sudo does not correctly validate the controlling terminal on a system without /proc or when the tty_tickets option is enabled. sudo does not properly handle the clock when it is set to the epoch. Impact : A local attacker with sudo privileges could connect to the stdin, stdout, and stderr of the terminal of a user who has authenticated with sudo, allowing the attacker to hijack the authorization of the other user. Additionally, a local or physically proximate attacker could set the system clock to the epoch, bypassing time restrictions on sudo authentication. Workaround : There is no known workaround at this time.
    last seen 2018-12-08
    modified 2018-12-05
    plugin id 72078
    published 2014-01-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72078
    title GLSA-201401-23 : sudo: Privilege escalation
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1353.NASL
    description An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776) This update also fixes the following bugs : * Due to a bug in the cycle detection algorithm of the visudo utility, visudo incorrectly evaluated certain alias definitions in the /etc/sudoers file as cycles. Consequently, a warning message about undefined aliases appeared. This bug has been fixed, /etc/sudoers is now parsed correctly by visudo and the warning message no longer appears. (BZ#849679) * Previously, the 'sudo -l' command did not parse the /etc/sudoers file correctly if it contained an Active Directory (AD) group. The file was parsed only up to the first AD group information and then the parsing failed with the following message : sudo: unable to cache group ADDOM\admingroup, already exists With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly. (BZ#855836) * Previously, the sudo utility did not escape the backslash characters contained in user names properly. Consequently, if a system used sudo integrated with LDAP or Active Directory (AD) as the primary authentication mechanism, users were not able to authenticate on that system. With this update, sudo has been modified to process LDAP and AD names correctly and the authentication process now works as expected. (BZ#869287) * Prior to this update, the 'visudo -s (strict)' command incorrectly parsed certain alias definitions. Consequently, an error message was issued. The bug has been fixed, and parsing errors no longer occur when using 'visudo -s'. (BZ#905624) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues.
    last seen 2018-11-29
    modified 2018-11-28
    plugin id 79154
    published 2014-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79154
    title CentOS 5 : sudo (CESA-2013:1353)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1754-1.NASL
    description Marco Schoepl discovered that Sudo incorrectly handled time stamp files when the system clock is set to epoch. A local attacker could use this issue to run Sudo commands without a password prompt. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-12-02
    modified 2018-12-01
    plugin id 64969
    published 2013-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64969
    title Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : sudo vulnerability (USN-1754-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1701.NASL
    description An updated sudo package that fixes two security issues, several bugs, and adds two enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-2776, CVE-2013-2777) This update also fixes the following bugs : * Previously, sudo did not support netgroup filtering for sources from the System Security Services Daemon (SSSD). Consequently, SSSD rules were applied to all users even when they did not belong to the specified netgroup. With this update, netgroup filtering for SSSD sources has been implemented. As a result, rules with a netgroup specification are applied only to users that are part of the netgroup. (BZ#880150) * When the sudo utility set up the environment in which it ran a command, it reset the value of the RLIMIT_NPROC resource limit to the parent's value of this limit if both the soft (current) and hard (maximum) values of RLIMIT_NPROC were not limited. An upstream patch has been provided to address this bug and RLIMIT_NPROC can now be set to 'unlimited'. (BZ#947276) * Due to the refactoring of the sudo code by upstream, the SUDO_USER variable that stores the name of the user running the sudo command was not logged to the /var/log/secure file as before. Consequently, user name 'root' was always recorded instead of the real user name. With this update, the previous behavior of sudo has been restored. As a result, the expected user name is now written to /var/log/secure. (BZ#973228) * Due to an error in a loop condition in sudo's rule listing code, a buffer overflow could have occurred in certain cases. This condition has been fixed and the buffer overflow no longer occurs. (BZ#994626) In addition, this update adds the following enhancements : * With this update, sudo has been modified to send debug messages about netgroup matching to the debug log. These messages should provide better understanding of how sudo matches netgroup database records with values from the running system and what the values are exactly. (BZ#848111) * With this update, sudo has been modified to accept the ipa_hostname value from the /etc/sssd/sssd.conf configuration file when matching netgroups. (BZ#853542) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.
    last seen 2018-11-13
    modified 2018-11-10
    plugin id 71017
    published 2013-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71017
    title RHEL 6 : sudo (RHSA-2013:1701)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_SUDO_20130611.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch. (CVE-2013-1775) - sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions. (CVE-2013-1776)
    last seen 2018-11-17
    modified 2018-11-15
    plugin id 80779
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80779
    title Oracle Solaris Third-Party Patch Update : sudo (multiple_permissions_privileges_and_access)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_8_5.NASL
    description The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components : - Apache - Bind - Certificate Trust Policy - CoreGraphics - ImageIO - Installer - IPSec - Kernel - Mobile Device Management - OpenSSL - PHP - PostgreSQL - Power Management - QuickTime - Screen Lock - sudo This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit. Note that successful exploitation of the most serious issues could result in arbitrary code execution.
    last seen 2018-09-01
    modified 2018-07-14
    plugin id 69877
    published 2013-09-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69877
    title Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-3297.NASL
    description - update to 1.8.6p7 - fixes CVE-2013-1775 and CVE-2013-1776 - fixed several packaging issues (thanks to ville.skytta at iki.fi) - build with system zlib. - let rpmbuild strip libexecdir/*.so. - own the %%{_docdir}/sudo-* dir. - fix some rpmlint warnings (spaces vs tabs, unescaped macros). - fix bogus %%changelog dates. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-12-08
    modified 2018-12-05
    plugin id 65590
    published 2013-03-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65590
    title Fedora 18 : sudo-1.8.6p7-1.fc18 (2013-3297)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1353.NASL
    description An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled time stamp files. An attacker able to run code as a local user and with the ability to control the system clock could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1775) It was found that sudo did not properly validate the controlling terminal device when the tty_tickets option was enabled in the /etc/sudoers file. An attacker able to run code as a local user could possibly gain additional privileges by running commands that the victim user was allowed to run via sudo, without knowing the victim's password. (CVE-2013-1776, CVE-2013-2776) This update also fixes the following bugs : * Due to a bug in the cycle detection algorithm of the visudo utility, visudo incorrectly evaluated certain alias definitions in the /etc/sudoers file as cycles. Consequently, a warning message about undefined aliases appeared. This bug has been fixed, /etc/sudoers is now parsed correctly by visudo and the warning message no longer appears. (BZ#849679) * Previously, the 'sudo -l' command did not parse the /etc/sudoers file correctly if it contained an Active Directory (AD) group. The file was parsed only up to the first AD group information and then the parsing failed with the following message : sudo: unable to cache group ADDOM\admingroup, already exists With this update, the underlying code has been modified and 'sudo -l' now parses /etc/sudoers containing AD groups correctly. (BZ#855836) * Previously, the sudo utility did not escape the backslash characters contained in user names properly. Consequently, if a system used sudo integrated with LDAP or Active Directory (AD) as the primary authentication mechanism, users were not able to authenticate on that system. With this update, sudo has been modified to process LDAP and AD names correctly and the authentication process now works as expected. (BZ#869287) * Prior to this update, the 'visudo -s (strict)' command incorrectly parsed certain alias definitions. Consequently, an error message was issued. The bug has been fixed, and parsing errors no longer occur when using 'visudo -s'. (BZ#905624) All sudo users are advised to upgrade to this updated package, which contains backported patches to correct these issues.
    last seen 2018-11-27
    modified 2018-11-26
    plugin id 70249
    published 2013-10-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70249
    title RHEL 5 : sudo (RHSA-2013:1353)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2013-004.NASL
    description The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied. This update contains several security-related fixes for the following component : - Apache - Bind - Certificate Trust Policy - ClamAV - Installer - IPSec - Mobile Device Management - OpenSSL - PHP - PostgreSQL - QuickTime - sudo Note that successful exploitation of the most serious issues could result in arbitrary code execution.
    last seen 2018-09-02
    modified 2018-07-14
    plugin id 69878
    published 2013-09-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69878
    title Mac OS X Multiple Vulnerabilities (Security Update 2013-004)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-3270.NASL
    description - update to 1.8.6p7 - fixes CVE-2013-1775 and CVE-2013-1776 - fixed several packaging issues (thanks to ville.skytta at iki.fi) - build with system zlib. - let rpmbuild strip libexecdir/*.so. - own the %%{_docdir}/sudo-* dir. - fix some rpmlint warnings (spaces vs tabs, unescaped macros). - fix bogus %%changelog dates. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-12-08
    modified 2018-12-05
    plugin id 65619
    published 2013-03-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65619
    title Fedora 17 : sudo-1.8.6p7-1.fc17 (2013-3270)
packetstorm via4
redhat via4
advisories
  • rhsa
    id RHSA-2013:1353
  • rhsa
    id RHSA-2013:1701
rpms
  • sudo-0:1.7.2p1-28.el5
  • sudo-0:1.8.6p3-12.el6
  • sudo-devel-0:1.8.6p3-12.el6
refmap via4
apple
  • APPLE-SA-2013-09-12-1
  • APPLE-SA-2015-08-13-2
bid 58203
confirm
debian DSA-2642
mlist [oss-security] 20130227 CVE request: sudo authentication bypass when clock is reset
osvdb 90677
slackware SSA:2013-065-01
suse openSUSE-SU-2013:0495
ubuntu USN-1754-1
the hacker news via4
id THN:7BDF45E62E28D5D2D535B9AE55F8A825
last seen 2017-01-08
modified 2013-08-30
published 2013-08-30
reporter Mohit Kumar
source http://thehackernews.com/2013/08/apple-mac-os-x-vulnerability-enables.html
title Apple Mac OS X Vulnerability enables Root User to Hackers by resetting the clock
Last major update 28-11-2016 - 14:08
Published 05-03-2013 - 16:38
Back to Top