PT-2013-3921 · Todd Miller+4 · Sudo+4
Vincent Danen
·
Publicado
2013-04-08
·
Atualizado
2017-08-29
·
CVE-2013-2776
CVSS v2.0
4.4
Média
| Vetor | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
sudo versions 1.3.5 through 1.7.10p5
sudo versions 1.8.0 through 1.8.6p6
Description
The issue allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal, when running on systems without /proc or the sysctl function with the tty tickets option enabled.
Recommendations
For sudo versions 1.3.5 through 1.7.10p5, update to a version outside of this range to resolve the issue.
For sudo versions 1.8.0 through 1.8.6p6, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider disabling the tty tickets option until a patch is available.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Sudo